On Apr 7, 2010, at 11:52 PM, Vlabs .C wrote:
> i am developing a small sniffer using libpcap API's. I want to capture,
> process ARP, IP and TCP packets at a time. Right now I am not able find how
> to do it using pcap_compile to capture more than one type of packet at a
> time.
"arp or ip"
is the filter to pass to pcap_compile() in that case (TCP packets *are* IP
packets).
If you want to capture both IPv4 and IPv6, do
"arp or ip or ip6"-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
