I figured out how to spec the other interface.
Chuck
D:\Profiles\cngr85\Desktop\dump>windump -i
\Device\NPF_{38D6F9C0-8D21-4EFF-947C-9CB2FFE9D2FD} -d "tcp[13] & 0x02 =
2"
windump: listening on \Device\NPF_{38D6F9C0-8D21-4EFF-947C-9CB2FFE9D2FD}
(000) ldh [12]
(001) jeq #0x800 jt 2 jf 11
(002) ldb [23]
(003) jeq #0x6 jt 4 jf 11
(004) ldh [20]
(005) jset #0x1fff jt 11 jf 6
(006) ldxb 4*([14]&0xf)
(007) ldb [x + 27]
(008) and #0x2
(009) jeq #0x2 jt 10 jf 11
(010) ret #96
(011) ret #0
D:\Profiles\cngr85\Desktop\dump>windump -i
\Device\NPF_{38D6F9C0-8D21-4EFF-947C-9CB2FFE9D2FD} -d "tcp[13:1] = 2"
windump: listening on \Device\NPF_{38D6F9C0-8D21-4EFF-947C-9CB2FFE9D2FD}
(000) ldh [12]
(001) jeq #0x800 jt 2 jf 10
(002) ldb [23]
(003) jeq #0x6 jt 4 jf 10
(004) ldh [20]
(005) jset #0x1fff jt 10 jf 6
(006) ldxb 4*([14]&0xf)
(007) ldb [x + 27]
(008) jeq #0x2 jt 9 jf 10
(009) ret #96
(010) ret #0
