> we only need two cases (IP address and port, IP address only) here.
So we're eliminating the port-only (e.g. when it's IPSEC-encapsulated) case? > "udp destination port number 0" is outside of the spec, it is > not allowed. But it might appear anyway; one of tcpdump's reasons for being is to debug problems and udp dest port 0 is a problem =) Bill - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
