tcpdump question (was Re: [vox-tech] tight-vnc, can't ping box from windows)

[Jeff Newmiller]

On Thu, 27 Jan 2005, Peter Jay Salzman wrote:

> On Thu 27 Jan 05,  8:10 AM, Peter Jay Salzman <p at dirac.org> said:

[...]

> BTW, a question to the list.  The man page claims the expression to listen
> to icmp pings should be:
> 
>    tcpdump ip proto icmp
> 
> But that gave a parse error.  By trial and error, I found this works:
> 
>    tcpdump icmp
> 
> Am I reading the man page wrongly or is the man page wrong?

There is a warning about this in my manpage... you'll have to decide where
your problem is:

  ip proto protocol
    True if the packet is an IP packet (see ip(4P)) of protocol type
    protocol.  Protocol can be a  number  or  one  of the names icmp,
    icmp6, igmp, igrp, pim, ah, esp, vrrp, udp, or tcp.  Note that the
    identifiers tcp, udp, and icmp are also keywords and must be escaped
    via backslash (\), which is \\ in the C-shell.  Note that this
    primitive does not chase the protocol header chain.

---------------------------------------------------------------------------
Jeff Newmiller                        The     .....       .....  Go Live...
DCN:<jdnewmil at dcn.davis.ca.us>        Basics: ##.#.       ##.#.  Live Go...
                                      Live:   OO#.. Dead: OO#..  Playing
Research Engineer (Solar/Batteries            O.O#.       #.O#.  with
/Software/Embedded Controllers)               .OO#.       .OO#.  rocks...1k
---------------------------------------------------------------------------