Re: multicast & icmp packet printing

[Guy Harris <guy () alum mit edu>]

On Wed, Mar 19, 2003 at 02:44:23PM -0800, Larry Platzek wrote:
> tcpdump -i ppp0 'ether[0] & 1 != 0'
> This shows the multicast packets.

ppp0?  What's the definition of a "multicast packet" over PPP?

> tcpdump -i ppp0 'ether[0] & 1 != 0 or icmp[0] =8 or icmp[0] = 0 '
> only shows the ping request and ping reply packets
> so what happened to the multicast packets?

Did any multicast packets arrive on that interface while you were
running tcpdump?  I tried it with both the FreeBSD tcpdump 3.4/libpcap
0.4 and the current CVS versions of libpcap and tcpdump, reading from a
capture that contained multicast packets, and it worked.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe