I'm messing about with some link-layer stuff, and in the testing thereof
I've experimented with sending to a broadcast address. However, when I say:
tcpdump -i eth0 not ip and not multicast and not arp
I do not see my broadcast frame being sent (which is neither IP, nor
ARP, but is an 802.2 TEST frame) However if I drop "and not multicast"
I will see my broadcast frame.
Given there is also an alias for broadcast that behaviour seems
incorrect - "not multicast" should still show broadcast. Thoughts?
This is with 4.1.1 and libpcap 1.1.1.
rick jones
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
