tcpdump mailing list archives
Re: Multiple pcap filters on interface
From: Guy Harris <guy () alum mit edu>
Date: Tue, 7 Oct 2008 18:40:01 -0700
On Oct 7, 2008, at 1:07 PM, Jim Mellander wrote:
All of the above are attempts to overcome the 'one filter per interfaceper process' model that I believe libpcap imposes
So why does it need overcoming? A filter says "only deliver me packets that match the following"; would multiple packets mean "deliver me packets that match any of the following", in which case that reduces to one filter (a || b || c ...), or "deliver me packets that match all of the following", in which case that reduces to one filter (a && b && c ...), or something else?
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Multiple pcap filters on interface Jim Mellander (Oct 07)
- Re: Multiple pcap filters on interface Guy Harris (Oct 07)
- Re: Multiple pcap filters on interface Guy Harris (Oct 07)
- Re: Multiple pcap filters on interface Fabian Schneider (Oct 07)
- Caching captured packets David Murray (Oct 09)