> I captured packets using linux's 'any' interface. At the time of > capturing, only 'lo' was active. I used 'nc' to generate packets on > 'lo'.
The "any" device is not an ethernet device, but a virtual thing that will bring you (at least on Linux) a "Linux Cooked" header instead of an ethernet header. You should google for "linux cooked header". - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
