[dr. zoidberg]

can anyone explain why i keep getting those stupid "parse errors" with tcpdump?

example:

bitcrash# tcpdump -i en0 -n proto udp
tcpdump: parse error

whereas:

bitcrash# tcpdump -i en0 -n proto gre
tcpdump: listening on en0

would work with no errors.

so what´s the dealio?

[dudesteve]

'udp' needs to be escaped because udp is a keyword (RTF manpage).
'gre' doesn't need to because it isn't a keyword.

BTW, it also works if you drop the 'proto' keyword and the escape, ie:

tcpdump -i en0 -n udp
or
tcpdump -i en0 -n gre

Why the difference? *shrug*