[Stuart Kendrick <skendric@xxxxxxxxx>]

> Correct.  For filter tests, it currently only generates BPF code where the data can be tested with a single comparison instruction, which means no more than 4 bytes (the BPF pseudo-machine is a 32-bit machine).
>
> > Can anyone think of a creative way to do the same thing?
>
> arp and ((ether[22:4]==0x001e4f3d and ether[26:2]==0x4204) or (ether[32:4]==0x001e4f3d) and ether[36:2]==0x4204))

Ahh.  Thank you Guy,

--sk