Ask Your Question

pcap compile failing where as same filter is functioning in wireshark gui

asked 2023-09-19 06:01:39 +0000

chakka.lokesh gravatar image

updated 2023-09-19 06:19:55 +0000

hello here is small piece of code. Not able to understand why pcap_compile is failing.


int main()
     char error_string[PCAP_ERRBUF_SIZE];
     pcap_t * capture = pcap_open_offline( "/home/lokesh/Desktop/capture_tls.pcapng", error_string );
     if( capture == NULL )
          fprintf( stderr, "%s %d %s\n", __func__, __LINE__, error_string );
          return 1;
     struct bpf_program bpf;
     if( pcap_compile( capture, &bpf, "ipv6.addr==2406:7400:63:12c2:868c:aa3:758e:d09", 0, PCAP_NETMASK_UNKNOWN ) ) 
          fprintf( stderr, "%s %d compile error: %s\n", __func__, __LINE__, pcap_geterr( capture ) );
          return 1;
     if( pcap_setfilter( capture, &bpf ) ) 
          fprintf( stderr, "%s %d set filter error: %s\n", __func__, __LINE__, pcap_geterr( capture ) );
     pcap_close( capture );
     return 0;

I am seeing the following error

main 15 compile error: can't parse filter expression: syntax error

Same filter is functioning fine in wireshark GUI.

can someone help me understand the issue ....


edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2023-09-20 08:22:58 +0000

Guy Harris gravatar image

Jaap is correct. The libpcap capture filter equivalent would be "ip6 host 2406:7400:63:12c2:868c:aa3:758e:d09"

edit flag offensive delete link more

answered 2023-09-19 08:45:03 +0000

Jaap gravatar image

You confusing a display filter for a capture filter.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2023-09-19 06:01:39 +0000

Seen: 183 times

Last updated: Sep 20 '23