I am trying to create a BPF filter expression that will capture only
packets with an 802.1X EAPOL header. Is this possible to do?
Thanks.
Vincent
almost certainly, but whether the compiler supports it is another story.
see the bpf instructions and look at pcap lib source code