Re: [Ethereal-users] Filterquestion: Checksum

["Guy Harris" <gharris@xxxxxxxxx>]

Uli Korn said:
> i need a capturefilter which only capture packets with a bad checksum.

Unfortunately, you can't get what you need - BPF (the filtering engine
used for capturing) doesn't support that.

You could try capturing with Tethereal using a "read filter", which lets
you use a display filter when capturing - but note that display filters
require more CPU to evaluate, *and* don't stop packets from being copied
from OS kernel buffers to Ethereal's buffers (unlike capture filters,
which, on some platforms, are interpreted by a BPF interpreter in the
kernel, so packets that don't pass the filter are discarded rather than
being copied to userland and filtered there).