With this patch (in libpcap), tcpdump can be used on the CIPE deviceso that it shows the traffic going over that device in unencryptedform. (tcpdump on the device which holds the UDP address will show theencrypted packets, for obvious reasons.) Similarly, on a conventionalIPIP tunnel, it will show the contents of the packets.These are two different patches, one for libpcap 0.3 and one forlibpcap 0.4 or 0.5. Look which one your version of tcpdump uses.--- libpcap-0.3/pcap-linux.c.orig       Wed Dec 11 08:15:00 1996+++ libpcap-0.3/pcap-linux.c        Thu Jul 31 10:39:42 1997@@ -160,6 +160,10 @@                p->linktype = DLT_NULL;                p->md.pad = 2;                p->md.skip = 12;+       } else if (strncmp("tunl", device, 4) == 0) {+               p->linktype = DLT_RAW;+       } else if (strncmp("cip", device, 3) == 0) {+               p->linktype = DLT_RAW;        } else {                sprintf(ebuf, "linux: unknown physical layer type");                goto bad;--- libpcap-0.4a6/pcap-linux.c.orig     Fri Oct  3 07:39:53 1997+++ libpcap-0.4a6/pcap-linux.c  Mon May 18 11:15:35 1998@@ -235,6 +235,11 @@                break; #endif+       case ARPHRD_TUNNEL:+               /* XXX I dont know if this is correct but it works for CIPE */+               p->linktype = DLT_RAW;+               break;+ #ifdef notdef        case ARPHRD_LOCALTLK:        case ARPHRD_NETROM: