Re: [Fwd: Re: Announcing: ANEP-enabled Tcpdump]

[Kristin Wright <kwright@marker.cs.utah.edu>]

>   *> 	tcpdump -T anep -s 80 host kamas 
>   *> 
> 
> Request for clarification:
> 
> Does this dump all packets to/from kamas, or only those packets with
> an ANEP header, or only those packets with the ANEP UDP port or
> the ANEP protocol ID?

The above expression is TRUE if either the IP source or destination
of the packet is host. That is, all packets from/to host kamas
will be parsed and the output formatted as if the packets were 
ANEP packets. More precise tcpdump expressions can be constructed
if necessary.

Packets will also be parsed as ANEP packets in the following 
situations:

- If the UDP port is one of the ANANA UDP numbers (3322,3323,3324,3325)
- If the IP protocol ID is the ANANA ANEP number (107)

The "anep" type addition to tcpdump's "-T" option is convenient 
because (1) most packets today don't have the IP protocol ID set to 
ANEP (it's usually set to UDP) (2) many apps are not restricted to the 
UDP ports listed above.

-kw