On Thu, Mar 27, 2003 at 04:03:11PM -0800, Larry Platzek wrote: > I tried using 'ip[16]=224' which seems to work also tried 'ip multicast' > and that seems to work. Is one method better than the other?
"ip multicast" is equivalent to "ip[16]=224", but it's cleaner (it more clearly expresses what you're testing for). - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
