README

ETHDUMP(1)                                                                      

NAME
       ethdump - A bad imitation of tcpdump

SYNOPSIS
       ethdump [ -f filter ]
               -i interface

DESCRIPTION
        An incomplete, slow, and bug-ridden implemention of tcpdump except only
        for fields of the ethernet header (and some IP headers).

OPTIONS
       -i     Specify the network interface to dump ethernet packets from.

       -f     Define a filter. Only packets that match the filter will be
              displayed.

FILTERS

    A filter is defined by:
        
        FIELD OPERATOR VALUE

    FIELD describes a field of the packet and can be one of:
        
        ethsrc     The source MAC address of the ethernet packet.
        ethdst     The destination MAC address of the ethernet packet
        ethtype    The type of the ethernet packet (as defined by IEEE 802).

        ipsrc      The source IPv4 address of the IP packet.
        ipdst      The destination IPaddress of the IP packet.
        iptype     IP protocol header.

    OPERATOR describes the comparison to make on the field. It can be one of:

        ==      Equals
        !=      Not equals

    VALUE is an argument to the operator. It must be a either:

        ipaddr     An IPv4 address literal: 4 bytes separated by dots, for
                   example 192.168.87.20.

        ethaddr    A MAC address literal: 6 pairs of hex digits separated by
                   colons, for example de:ad:12:be:ef:34.

        number     A positive integer.