On Mon, Jun 10, 2002 at 04:36:57PM -0700, Smith, Kevin C wrote:
> What filter could I put in place to filter ipsec, or ip protocal number
> 50.
> It is flooding my logs.
A filter to capture *only* IPSEC, or a filter *not* to capture IPSEC?
To capture only IP protocol 50:
ip proto 50
To *avoid* capturing IP protocol 50:
not ip proto 50
Depending on the contents of "/etc/protocols"
ip proto esp
and
not ip proto esp
might also work.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
