Re: does "port 25" work?

[Guy Harris <guy () alum mit edu>]

On Jul 31, 2008, at 10:48 AM, U. George wrote:

> why does adding the "PORT" conditional also modify the wild-card  
> aspects of "ethernet type"

To what "wild-card aspects of 'ethernet type'" are you referring?

If you say "port domain", that can only match TCP or UDP packets,  
which means it can only match IP packets, which means it *cannot*  
match arbitrary Ethernet types.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.