Re: [tcpdump-workers] Pcap filter

2006-04-01 Thread Dan Joumaa
Alexander Dupuy wrote: The ethernet frame has dest address first, then source. You want ether[6] through ether[8] for source address filtering. @alex Ah, I see. The funny thing is, when I try this in tcpdump, it works, but in my app I still don't get any packets. I've scanned through

[tcpdump-workers] How to use "pcap" on a router

2006-04-01 Thread kashif javed
Dear, I have configured my PC running RedHat Linux 9.0 into a router by turning on the ip_forwarding facility of it. It got TWO LAN cards... running two instances of *pcap* for capturing packets is working fineBut i intend to write an application wherein i need the information captured by bot