>> Unless somebody comes up with a good reason *NOT* to make "-e" cause >> "-x" and "-X" to dump the link-layer header, > >Actually, I can think of a reason why we might not want to to it - it >might break scripts that parse the result of "tcpdump -e -x" *and* that >expect the hex dump not to include the link-layer header. > >The "link-layer header isn't dumped" is documented going back at least >as far as tcpdump 3.4: > > -x Print each packet (minus its link level header) in > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > hex. The smaller of the entire packet or snaplen bytes > will be printed. > >so perhaps we should add a new command-line flag to handle that (or, >along the lines of "-t" vs. "-tt" and "-v" vs. "-vv", have "-xx" and >"-XX" cause the link-layer header to be printed).
excellent point, imo, and an elegant solution. -- |-----< "CODE WARRIOR" >-----| [EMAIL PROTECTED] * "ah! i see you have the internet [EMAIL PROTECTED] (Andrew Brown) that goes *ping*!" [EMAIL PROTECTED] * "information is power -- share the wealth." - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
