[prev in list] [next in list] [prev in thread] [next in thread] 

List:       tcpdump-workers
Subject:    Re: [tcpdump-workers] Pcap filter
From:       Dan Joumaa <nessup () gmail ! com>
Date:       2006-04-01 23:25:43
Message-ID: 442F0BF7.9090906 () gmail ! com
[Download RAW message or body]

Alexander Dupuy wrote:
> The ethernet frame has dest address first, then source. You want ether[6] through \
> ether[8] for source address filtering. 
> 
> @alex
> 
> 
Ah, I see.

The funny thing is, when I try this in tcpdump, it works, but in my app 
I still don't get any packets.

I've scanned through the tcpdump code and it is pretty much doing the 
exact same thing as my app in terms of setting the filter, so I'm 
clueless on why it wouldn't work. :/

--ness
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.


[prev in list] [next in list] [prev in thread] [next in thread]