Wireshark · Ethereal-users: Re: [Ethereal-users] Display Filter and Capture Filter

[Jeff Heath <jheath1@xxxxxxxxxxxxx>]

On Mon, 2005-03-07 at 02:47, Eric Lam, Fu Wa wrote:
> Dear all,
> 
>  
> 
> I am new to Ethereal (0.10.7). I set up a display filter
> (mgcp.rsp.rspcode >= 500 and mgcp.rsp.rspcode <= 530 and
> mgcp.rsp.rspcode != 501 and mgcp.rsp.rspcode != 510). Would anyone
> teach me how to setup the capture filter so that only the traffic with
> (mgcp.rsp.rspcode >= 500 and mgcp.rsp.rspcode <= 530 and
> mgcp.rsp.rspcode != 501 and mgcp.rsp.rspcode != 510) will be captured.
> Many thanks.
> 
snip

Eric,

In Ethereal the capture filters and the display filters operate quite
differently.   The capture filters are limited to what is possible with
tcpdump, which is quite a bit less than what is possible with the
display filters.  Unfortunately, what you are trying to do is not
possible with a capture filter.  For more information, download the
Ethereal manual and search on capture filters.

Jeff