With that version, PPP packets are filterable, but unfortunately, the
Linux kernel is not returning the PPP protocol type to the user-level
code, so tcpdump is just assuming that the packets are IP packets.
However, it works most of the time. What is needed is to fix Linux to
return the link-level information on PPP raw sockets, and then fix
tcpdump to read the protocol type.
tcpdump is still printing all packets twice when looking at the
loopback device, probably because the kernel is returning them twice.
Dale
-- Dale R. Worley Ariadne Internet Services Voice: +1 617-899-7949 Fax: +1 617-899-7946 E-mail: worley@ariadne.com "Internet-based electronic commerce solutions to real business problems."