is "not multicast" supposed to include broadcast?

[Rick Jones <rick.jones2 () hp com>]

I'm messing about with some link-layer stuff, and in the testing thereof 
I've experimented with sending to a broadcast address.  However, when I say:

tcpdump -i eth0 not ip and not multicast and not arp

I do not see my broadcast frame being sent (which is neither IP, nor 
ARP, but is an 802.2 TEST frame)  However if I drop "and not multicast" 
I will see my broadcast frame.

Given there is also an alias for broadcast that behaviour seems 
incorrect - "not multicast" should still show broadcast.  Thoughts?

This is with 4.1.1 and libpcap 1.1.1.

rick jones
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.