Re: Max lines in filter

[Guy Harris <guy () netapp com>]

On Mon, Dec 09, 2002 at 04:22:36PM -0800, Keplinger, Michael A wrote:
> Does anybody know if there is a maximum number of lines that you can
> have in a tcpdump filter,

That depends on the version of libpcap you're using.  There was, as I
remember, a bug with Really Large Expressions (I don't know how large
Really Large is), that was fixed at some point.  I created a file with
255 lines:

        host 0.0.0.1 or
        host 1.0.0.1 or

                ...

        host 253.0.0.1 or
        host 254.0.0.1

and the old tcpdump 3.4 installed here, linked with libpcap 0.4, crashed
when I tried that, but the current CVS version of tcpdump, linked with
the current CVS version of libpcap, didn't.

I don't remember what the change is, or when it went in, so I don't know
if the current released version of libpcap (0.7.1) has the fix or not.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe