Greetings,
Attached is a small patch which makes libpcap filter expressions a bit
more tolerant towards ethernet (MAC) address notations.
When troubleshooting network problems, me and my colleagues often want
to cut-and-paste MAC addresses as displayed by network equipment.
However, modern equipment show addresses in notations that are not
accepted in libpcap filter expressions. Changing the notation each
time is trivial but annoying. It seems unlikely that we are the only
ones doing this. Therefore we would like to propose this patch.
With this patch the following notation forms are accepted as valid
addresses:
\1 xx:xx:xx:xx:xx:xx
\2 xxxx.xxxx.xxxx
\3 xx-xx-xx-xx-xx-xx
\4 xx.xx.xx.xx.xx.xx
\5 xxxxxxxxxxxx
\1 is the common notation; \2 is the Cisco-like notation, as used by
many equipment vendors; \3 seems preferred by the IEEE and in many
books. While testing this patch, I discovered that Debian applies a
similar, independently developed, patch just to allow notations \4 and
\5.
Please review this patch and consider it for some future release. If
needed, I can make a patch for CVS HEAD. The same diff was uploaded to
sourceforge.
Kind regards, Arien
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
