Re: [Wireshark-users] capture filter of PPP LCP

2007-12-24 Thread cw
Hi! ppp[0:2]=0xc021 is a capture filter, not dispaly filter. I have solved this problem, because in my case, ppp is encapsulated in PPPoE, not directly in Ether, so ppp[0:2]=0xc021 can not capture PPP LCP packets. Thanks a lot! ---

[Wireshark-users] capture filter of PPP LCP

2007-12-23 Thread cw
Hello everyone! I'd like to write a capture filter, to capture only PPP LCP packets, I use ppp[0:2] = 0xc021, the first two bytes "0xc021" of PPP header means Link Control Protocol(LCP), this capture filter should work, but it captures nothing, why? Any suggestion is welcome. Best Regards