title: Filtering packets in pcap dump file
body: <p>I'm writing network analyzer and I need to filter packets saved in file, I have written some code to filter http packets but I'm not sure if it work as it should because when I use my code on a pcap dump the result is 5 packets but in wireshark writing http in filter gives me 2 packets and if I use: </p>
  
  <pre><code>tcpdump port http -r trace-1.pcap
  </code></pre>
  
  <p>it gives me 11 packets.</p>
  
  <p>Well, 3 different results, that's a little confusing.</p>
  
  <p>The filter and the packet processing in me code is:</p>
  
  <pre><code>...
  if (pcap_compile(handle, &amp;fcode, "tcp port 80", 1, netmask) &lt; 0)
  ...
  while ((packet = pcap_next(handle,&amp;header))) {
      u_char *pkt_ptr = (u_char *)packet; 
  
      //parse the first (ethernet) header, grabbing the type field
      int ether_type = ((int)(pkt_ptr[12]) &lt;&lt; 8) | (int)pkt_ptr[13];
      int ether_offset = 0;
  
      if (ether_type == ETHER_TYPE_IP) // ethernet II
          ether_offset = 14;
      else if (ether_type == ETHER_TYPE_8021Q) // 802
          ether_offset = 18;
      else
          fprintf(stderr, "Unknown ethernet type, %04X, skipping...\n", ether_type);
  
      //parse the IP header
      pkt_ptr += ether_offset;  //skip past the Ethernet II header
      struct ip_header *ip_hdr = (struct ip_header *)pkt_ptr; 
      int packet_length = ntohs(ip_hdr-&gt;tlen);
  
      printf("\n%d - packet length: %d, and the capture lenght: %d\n", cnt++,packet_length, header.caplen);
  
  }
  </code></pre>
  
  <p>My question is why there are 3 different result when filtering the http? And/Or if I'm filtering it wrong then how can I do it right, also is there a way to filter http(or ssh, ftp, telnet ...) packets using something else than the port numbers?</p>
  
  <p>Thanks</p>