Bug#299642: filter expressions not working in tcpdump and tethereal

[Tyler West]

Package: libpcap0.8 Version:  0.8.3-5   Something seems to be broken with libpcap under Debian Sarge.  When capturing traffic on a particular host, if I execute my tcpdump or tethereal without a filter _expression_, I can see traffic captured for host a.b.c.d.  However if I add the filter _expression_ ‘host a.b.c.d’ to the end of my tcpdump or tethereal command it doesn’t appear to capture any packets.  In doing some basic research I saw where a similar bug had occurred a couple of years ago but I am not a programmer and simply had to stop at a point in the research when it got over my head.  This problem also appears to affect other filter expressions as well.  Without a filter _expression_ I can see obvious HTTP traffic but if I append ‘port 80’ it won’t capture anything.   I am running Debian Sarge with kernel 2.6.8-1 (default install, non-custom).  I’m assuming the problem is with libpcap since it affects both tcpdump and tethereal.  I have multiple Broadcom BCM5782 NICs using the tg3 driver.  My shared C library is libc-2.3.2.so.   Thanks,     Tyler West, CCNA Senior Network Engineer Dollar General Corporation