Re: tcpdump in testing busted?

[Matthew Kirkwood <matthew@hairy.beasts.org>]

On Tue, 23 Oct 2001, Gordon Sadler wrote:

> > Am I on drugs, or should:
> > # tcpdump -n -i eth1 not port ssh
> > work?

> Other than changing s/eth1/eth0/ as I do not have eth1 here, the above
> command appears to function just fine on my Debian (Sid) box.
>
> You'd have to be a bit more specific as to what is {not} working.

Oops, terribly sorry all.  I did mean to include another line.
Here's a simpler example:

# tcpdump port ssh
tcpdump: parse error

also:

# tcpdump port 22
tcpdump: parse error

I believe my /etc/services is OK, and a binary copied from a
RH7.0 host works just fine.  I have:

$ dpkg -l libpcap0
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name           Version        Description
+++-==============-==============-============================================
ii  libpcap0       0.6.2-2        System interface for user-level packet captu

Cheers,

Matthew.