True if the packet has a length greater than or equal to length . Protocol can be a number or one of the names icmp , igrp , udp , nd , or tcp . The ether keyword is optional. The ether keyword is optional. True if the packet is an IP multicast packet.
Protocol can be a number or a name like ip , arp , or rarp .
Note that tcpdump does not currently know how to parse these protocols. Proto is one of ether, fddi, ip, arp, rarp, tcp, udp, or icmp , and indicates the protocol layer for the index operation. The byte offset, relative to the indicated protocol layer, is given by expr . The length operator, indicated by the keyword len , gives the length of the packet. This check is implicitly applied to the tcp and udp index operations.