>On an interface where there are link-layer addresses, you can try to determine whether a packet is incoming or outgoing by >seeing whether the link-layer address is that of the interface or not. I don't know whether that's guaranteed or not.
That would be my first question. Any way to determine if the Link Layer address was not spoofed? - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED] - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
