How to set pcap filter to capture only UDP frames

Hi,
How can i set the pcap filter to capture only UDP frames?
Consulting the documentation of pcap i found that i should use pcap_compile and in the 3rd argument i enter the filter string
when i enter
1
2
3
4
5
6
7
8
filter=(char*)"ip proto udp";
if (pcap_compile(adhandle, &fcode,filter, 1, netmask) <0 )
    {
        fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
        /* Free the device list */
        pcap_freealldevs(alldevs);
                exit(1);
    }


i receive frames where the protocol feild differs from 17 ( the value of udp protocol)
Please any idea to solve this?
Thanks
You need to add a capture filter to the BPF. I have an example somewhere, I'll try to find it.
I will be very thankfull
So much data, so little time. I can't find the code I wrote just yet.

Check out these pages and look at how pcap_compile() is used. The second link describes the BPF filter syntax. Just specifying "udp" should suffice to filter UDP traffic.
http://www.tcpdump.org/pcap.html
http://yuba.stanford.edu/~casado/pcap/section3.html
Topic archived. No new replies allowed.