UNIX for Dummies Questions & Answers

How do I use snoop command to capture multicast packets in the network?

According to the man page you can use
# snoop multicast

multicast
True if the packet is a multicast packet.
Equivalent to "ether[0] & 1 = 1".

Definition:
multicast

(1) In communications networks, to transmit a message to multiple recipents at the same time. Multicast is a one-to-many transmission similar to broadcasting, except that multicasting means sending to specific groups, whereas broadcasting implies sending to everybody. When sending large volumes of data, multicast saves considerable bandwidth, because the bulk of the data is transmitted once from its source through major backbones and is multiplied, or distributed out, at switching points closer to the end users.

According to the definition, using snoop multicast didn't work for me since it also gave me broadcast messages (Solaris). Piping to egrep seemed to work.

# snoop |egrep multicast