Hi Ed, this is strange, because at least:
# tcpdump tcp[0:2] \> 1 and tcp[0:2] \< 79 # tcpdump 'tcp[0:2] > 1 and tcp[0:2] < 79' both correctly work for me on # tcpdump -V tcpdump version 3.6 libpcap version 0.6 and # ./tcpdump -V tcpdump version 3.8 libpcap version 0.7.2 could it be your shell? -alexm 20:51 24/08/2004 On Tue, 24 Aug 2004, Ed Sawicki wrote: > I'm running the latest versions of tcpdump and pcap. I can't > filter on tcp port ranges. > > These don't work - no packets are captured: > > tcpdump -i eth1 tcp[0:2] > 1023 and tcp[0:2] < 60000 > tcpdump -i eth1 'tcp[0:2] > 1023 and tcp[0:2] < 60000' > tcpdump -i eth1 'tcp[0:2] > 1023' and 'tcp[0:2] < 60000' > tcpdump -i eth1 'tcp[0:2]>1023' and 'tcp[0:2]<60000' > tcpdump -i eth1 \( 'tcp[0:2] > 1023' and 'tcp[0:2] < 60000' \) > > Is there a way to make this work? > > Ed > - > This is the tcpdump-workers list. > Visit https://lists.sandelman.ca/ to unsubscribe. > - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
