On Jul 22, 2004, at 12:25 PM, Hu Thomas Pan wrote:
I have a pcap filter string: udp and \( \( host host1 and port port1 \) or
\( host host2 and port port2 \) \)
Things are working through command line for tcpdump. But, it doesn't work
for pcap lib in the code.
Try using the string
"udp and ( ( host host1 and port port1 ) or ( host host2 and port port2 ) )"
as the string you pass to "pcap_compile()". The "\" before "(" and ")" in the tcpdump command line are to cause the shell not to treat them as special characters. They're removed by the shell when those arguments are passed to tcpdump.
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
