Is this a correct pcap filter expression

const char *str = "wlan subtype assoc-req or wlan subtype probe-req or wlan subtype probe-resp";
struct bpf_program fp;

if((pcap_compile(pkt_handle, &fp, str, 1, PCAP_NETMASK_UNKNOWN)==-1))
{
    pcap_perror(pkt_handle, "Compile");
}
else
    printf("filter compiled\n");

After running, the program displays "filter compiled", but it still captures Beacon frames and lots of other frames apart from the three mentioned in filter expression. So, is it the correct filter expression to catch only assoc-req, probe-req, probe-resp frames?

Answers


As interjay said, you have to call pcap_setfilter() to make the filter take effect. (Making it an answer so that the question shows up as having an answer.)


Need Your Help

How do I append a url typed into a input text field to an anchor then follow it when anchor is clicked?

javascript jquery html forms

I want to have a text field where people can type in a value. Then I want to have a href open a url with the text field appended to the end.

Lookahead (?=pattern) without preceding pattern

javascript regex lookahead

I learned that the lookahead regex is like this x(?=y) and means