Wireshark · Ethereal-users: RE: [Ethereal-users] 802.1Q and capture filters

["McNutt, Justin M." <McNuttJ@xxxxxxxxxxxx>]

More information:

If I use 'automatic scrolling in live capture', the problem does not occur.  I can use the same filter (with 'vlan and' at the beginning) as many times as I like.

--J

> -----Original Message-----
> From: Guy Harris [mailto:guy@xxxxxxxxxx]
> Sent: Friday, August 09, 2002 1:59 PM
> To: McNutt, Justin M.
> Cc: ethereal-users@xxxxxxxxxxxx
> Subject: Re: [Ethereal-users] 802.1Q and capture filters
> 
> 
> On Fri, Aug 09, 2002 at 06:47:55AM -0500, McNutt, Justin M. wrote:
> > Ideas?
> 
> Libpcap bug?  "vlan" temporarily modifies some internal variables in
> libpcap's code generator so that subsequent tests realize that packets
> are VLAN-encapsulated - but that shouldn't persist from expression to
> expression.
> 
> A problem like that wouldn't show up in tcpdump (or 
> Tethereal), as those
> programs only parse one capture filter expression each time you run
> them; Ethereal often catches problems such as that, as it 
> *can* compile
> more than one capture filter expression.
>