Forum Discussion
hooleylist
Jul 01, 2013Cirrostratus
Doh... thanks for catching that. I think we upgraded libpcap to 0.9.4 in 11.3.0 as part of BZ391286. That change should support the portrange keyword.
Prior to that, you can use this syntax:
(tcp[2:2] >= 4000 and tcp[2:2] <= 5000)
This uses the tcp offset for dst port (tcp[2:2) to create a range.
Aaron