> I haven't tried the CVS version yet, but e.g. can you select all 802.2
> non-SNAP IPX frames,
You have to do it by hand:
ether[12:2] < 1500 && ether[14:2] == 0xe0e0
or something such as that - i.e., check for a type/length field < 1500,
to select packets where it's a length field (i.e., 802.3 packets rather
than DIX packets), and then check for the first 2 bytes of the Ethernet
payload being 0xe0e0 (i.e., a frame with an LLC DSAP and SSAP of 0xe0).
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
