tcpdump filter syntax issue

This is a discussion on tcpdump filter syntax issue within the Linux Networking forums, part of the Linux Forums category; Perhaps not a linux specific issue, but I thought I'd start here. According to the tcpdump man page: ether ...


Go Back   Usenet Forums > Linux Forums > Linux Networking

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 07-31-2003
vom
 
Posts: n/a
Default tcpdump filter syntax issue

Perhaps not a linux specific issue, but I thought I'd start here.

According to the tcpdump man page:

ether proto protocol

True if the packet is of ether type protocol. Protocol
can be a number or one of the names ip, ip6, arp, rarp,
atalk, aarp, decnet, sca, lat, mopdl, moprc, iso, stp,
ipx, or netbeui. Note these identifiers are also key-
words and must be escaped via backslash (\).

So according to that, this should work:

[root@orbital tmp]# tcpdump -n -vvv ether proto \stp
tcpdump: parse error

Two slashes gets me a higher level error:

[root@orbital tmp]# tcpdump -n -vvv ether proto \\stp
tcpdump: unknown ether proto 'stp'

Two slashes with another protocol seems to work:

[root@orbital tmp]# tcpdump -n -vvv ether proto \\arp
tcpdump: listening on eth0
16:10:07.551223 arp who-has 192.168.65.2 tell 192.168.65.10
16:10:07.551351 arp who-has 192.168.65.3 tell 192.168.65.10
16:10:08.544725 arp who-has 192.168.65.2 tell 192.168.65.10
16:10:08.544728 arp who-has 192.168.65.3 tell 192.168.65.10
16:10:09.544721 arp who-has 192.168.65.2 tell 192.168.65.10
16:10:09.544727 arp who-has 192.168.65.3 tell 192.168.65.10

6 packets received by filter
0 packets dropped by kernel

However this _does_ work:

[root@orbital tmp]# tcpdump -n -vvv stp
tcpdump: listening on eth0
16:04:18.343589 802.1d config 8000.00:05:32:a3:9b:46.8026 root
8000.00:05:32:a3:9b:46 pathcost 0 age 0 max 20 hello 2 fdelay 15
16:04:20.346351 802.1d config 8000.00:05:32:a3:9b:46.8026 root
8000.00:05:32:a3:9b:46 pathcost 0 age 0 max 20 hello 2 fdelay 15
16:04:22.349545 802.1d config 8000.00:05:32:a3:9b:46.8026 root
8000.00:05:32:a3:9b:46 pathcost 0 age 0 max 20 hello 2 fdelay 15

3 packets received by filter
0 packets dropped by kernel

Is the man page out of date for the actual filter syntax ? And why do I
need two slashes ? Any insight would be appreciated. Thanks.

--
Brandon Applegate - CCIE 10273
PGP Key fingerprint:
7407 DC86 AA7B A57F 62D1 A715 3C63 66A1 181E 6996
"SH1-0151. This is the serial number, of our orbital gun."

Reply With Quote
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 11:03 AM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0