Subject: [netatalk-admins] AFP packet filtering for tcpdump output

From: Tom Kacvinsky <[email-masked]>
Date: Wed, 04 Nov 1998 17:47:00 -0500 (EST)

Hi,

I've looked in the netatalk-admins archive and done
a search on the 'net, but I haven't found this:

  an AFP filter for output of tcpdump

does anyone know of something like this?  I know
EtherPeek can do this kind of thing, but I've
got to get that purchased (with a P.O. -- argh!), 
so it'll be at least a month before I see it.  
So I have to use tcpdump.

TIA,

Tom

---

From: "Fred Lindberg" <[email-masked]>
Date: Wed, 04 Nov 1998 17:31:04 -0600

>  an AFP filter for output of tcpdump

I've started on it modifying tcpdump-3.4a5 by adding more filtering. My
netatalk problem was with bad broadcast addresses. I completed nbpkup
stuff, broadcast address checking, GNI[R] and some ZIP stuff. I ran
into packets on our net with byte order problems, and never followed
up. tcpdump is funny, since it removes UDP encapsulation without trace,
and it's possible that the byte order differs depending on
encapsulation. I just don't know enough to figure it out.

What I have works a lot better than tcpdump for appletalk. All my
changes are clearly documented. I'd be extatic if someone were to
complete this or point me in the right direction. This is incomplete,
so please don't reexport it (unless you improve it). My plan was to
send diffs to the tcpdump maintainters:

ftp://ftp.id.wustl.edu/outgoing/lindberg/tcpdump-3.4a5.atalk.tgz

NOTE: This will create a tcpdump-3.4a5 directory, possibly overwriting
your virgin sources. Rename any tcpdump-3.4a5 directory to
tcpdump-3.4a5.orig. I'm happy to make a diff available.

-Sincerely, Fred

(Frederik Lindberg, Infectious Diseases, WashU, St. Louis, MO, USA)