The pcap filter language isn't very powerful. Once you get outside of the primitives it supplies, even very simple things become hard or impossible. The example

The pcap filter language isn't very powerful. Once you get outside of the primitives it supplies, even very simple things become hard or impossible. The examples here seem to be for doing pattern matching (with wildcards) on portions of DNS query packets. That's definitely in the range of things you can't coerce the pcap filter language to do an even adequate job on. (I once wanted a pcap filter that matched SYN packets with a wscale option set; it ended up being a 8kB long filter due to needing to handle different ordering of variable sized TCP options. It would have been pretty trivial to do in raw BPF).