why pcap_setfilter did not take effect

Question

I'm using libpcap as lib to write a C program for catching up coming IPs. my code snippet as following:

struct bpf_program filter;
pcap_compile(pcap_handle, &filter, "icmp[icmptype]=0 and '(dst 16.11.26.100 or dst 16.11.27.100)'", 1, 0);
pcap_setfilter(pcap_handle, &filter);

But it didn't work, I still could see other dest Ips rather than only the above two Ips.

Answer 1

You should always check for errors from library routine calls. If you'd checked for errors from pcap_compile(), you would have seen that the compile failed (due to the single quotes, although the error message would probably just be "syntax error").