On Oct 7, 2008, at 1:07 PM, Jim Mellander wrote:
All of the above are attempts to overcome the 'one filter per
interface
per process' model that I believe libpcap imposes
So why does it need overcoming? A filter says "only deliver me
packets that match the following"; would multiple packets mean
"deliver me packets that match any of the following", in which case
that reduces to one filter (a || b || c ...), or "deliver me packets
that match all of the following", in which case that reduces to one
filter (a && b && c ...), or something else?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
