Hello! > First of all, you cannot mangle the packet contents. It has been mangled by transformation. > Have a look at what the ipip.c driver does. No, really. IPIP reassigns the packet to tunnel device and old MAC header is deleted, IPIP header becomes new MAC header. I am afraid, to make tcpdump happy we have to relocate MAC. Alexey - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html