[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Wireshark: how can I give rights to interfaces without launching it as root?

Celejar wrote:
> On Fri, 25 Jun 2010 16:46:52 +0200
> Merciadri Luca <Luca.Merciadri@student.ulg.ac.be> wrote:
> /usr/share/doc/wireshark-common/README.Debian discusses wireshark and
> necessary privileges. This came up a while back on the lists, and
> someone said that this README, while in Sid, is not in earlier Debian
> versions.
I had already read it, but here is what it gives me:


Using the != operator on combined expressions like: eth.addr, ip.addr,
udp.port and alike will probably not work as expected!

Often people use a filter string to display something like ip.addr ==
which will display all packets containing the IP address

Then they use ip.addr != to see all packets not containing the
IP address in it. Unfortunately, this does not do the expected.
Instead, that expression will even be true for packets where either source
or destination IP address equals The reason for this, is that the
expression ip.addr != must be read as "the packet contains a field
named ip.addr with a value different from". As an IP datagram
contains both a source and a destination address, the expression will
to true whenever at least one of the two addresses differs from
If you want to filter out all packets containing IP datagrams to or from
IP address, then the correct filter is !(ip.addr == as it
reads "show me all the packets for which it is not true that a field named
ip.addr exists with a value of", or in other words, "filter out all
packets for which there are no occurrences of a field named ip.addr with the

This README does not solve my issue (or, if it should, I might be
misunderstanding it). :(

Merciadri Luca
See http://www.student.montefiore.ulg.ac.be/~merciadri/
I use PGP. If there is an incompatibility problem with your mail
client, please contact me.

What we do for ourselves dies with us. What we do for others and the
world remains and is immortal. (Albert Pine)

Attachment: signature.asc
Description: OpenPGP digital signature

Reply to: