RedHat's enhanced tcpdump ignores /etc/protocols; it has
hard-coded strings for the protocol names it recognizes: all
others are only accepted by number.  To fix:

#include <netdb.h>

Then, update eth_p_parse:

	if (!strcmp(id, "x25"))
		return htons(ETH_P_X25);

        /* Check for protocol in /etc/protocols: */
	if (pe = getprotobyname (id))
	  return htons (pe->p_proto);

	return htons(atoi(id));

libpcap seems to already do this it seems.


--binkley