Re: [tcpdump-workers] Any way to filter ether address when type is LINUX_SLL?

--- Begin Message --- For posterity, I did: ncat -l 12345 | tshark -r - -w - sll > w where w is named pipe. Instead of: ncat -l 12345 | tcpdump -r - -w - [pcap_filter] > w Your answer leads me to this solution, I needed an upper-level tool. Regards, Le 19/01/2021 à 15:45, Michael Richardson

Re: [tcpdump-workers] Any way to filter ether address when type is LINUX_SLL?

--- Begin Message --- And is there any way to filter by link-type? In fact, I need only those LINUX_SLL. Regards, Le 29/12/2020 à 22:39, Michael Richardson a écrit : Edouard Gaulué via tcpdump-workers wrote: > I get a pcap flow from my router box (Peplink). The only thing I can cha

[tcpdump-workers] Any way to filter ether address when type is LINUX_SLL?

--- Begin Message --- Hi all, I get a pcap flow from my router box (Peplink). The only thing I can change is the dev "interface" from a web page. If one is chosen, I've got a EN10MB type and I can filter my incoming flow with "tcpdump -r - -w - ether host 01:23:45:67:89:01". If I choose "All",