> P means the packet is going to some other host (and it was probably
> captured by promiscuity). If you dump IP tunnels, the tcpdump might
> wrongly check the interior datagram, and believe it's meant to someone
> else.
At least on Linux, tcpdump doesn't check the datagram, the kernel does -
the "P", "<", ">", etc. come from flags supplied by the kernel in the
sockaddr_ll structure.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
