Hi, Gerald Combs:
"pppoes && port 80" just works like a magic!
Thanks for help!
Tao, Regards.
On Thu, Aug 27, 2009 at 12:42 AM, Gerald Combs
<gerald@xxxxxxxxxxxxx> wrote:
Tao Zhou wrote:
> Yes, the http traffic is on port 80, not on other ports.
>
> as I said in the first email, that if I use 'Display Filter' as http
> while leaving the 'Capture Filter' empty, the http traffic could be
> filtered out on port 80;
> However, if use 'port 80' as 'Capture Filter' while leaving 'Display
> Filter' empty, no traffic could be captured.
>
> But today I found that the laptop NIC card has not obtained a valid IP
> address, as it uses DHCP; while STB got an public network IP address
> through PPPoE.
> So I guess maybe the root cause is that without an IP address for
> laptop, the 'Capture Filter' will make it could not capture any packets;
> while leaving it empty will get all packets in the hub successfully.
Are you trying to apply a capture filter to PPPoE traffic? If so, you
might want to try something like "pppoes && port 80". According to the
tcpdump man page you need to use it in order for your filter to use the
proper offsets.
