Wireshark · Ethereal-users: Re: [Ethereal-users] capture filter and greater than operand

[Guy Harris <gharris@xxxxxxxxx>]

John Que wrote:

> When with conjunction with another  than qualifier - it does ***NOT*** work.
> like 
> udp[2:2] > 8000 and udp[2:2] <8010
> or 
> (udp[2:2] > 8000 and udp[2:2] <8010)
> or 
> ( (udp[2:2] > 8000) and (udp[2:2] <8010) )
>
> I don't have a clue why joining both conditions does not work.

What does "ethereal -v" print?  Some versions of libpcap - including all 
the 0.8[.x] releases - had a bug that caused expressions of that sort 
not to work; that bug is fixed in libpcap 0.9[.x].  (0.9[.x] also 
supports the "portrange" operator, so you can do "udp portrange 
8001-8009" in applications that are using libpcap 0.9[.x].)