[tcpdump-workers] Why isn't 'ether proto \ip host host' a legal tcpdump expression?

Greetings! I'm trying to understand tcpdump expressions a bit more, and I'm confused about a basic example given in the pcap-filter man pages. They first state: | The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by one or more

Re: [tcpdump-workers] Why isn't 'ether proto \ip host host' a legal tcpdump expression?

On Wed, Oct 17, 2012 at 3:59 AM, Ezequiel Garzón wrote: > Greetings! I'm trying to understand tcpdump expressions a bit more, > and I'm confused about a basic example given in the pcap-filter man > pages. They first state: > > | The filter expression consists of one or more primitives. Primitives