[tcpdump-workers] mailman3 list imported

2023-02-15 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- The mailing list has been moved from a mailman2 host to a mailman3 host. I had subscribed everyone with an option to confirm, but that was a bad idea. I have now found the import21 command, and imported the "pickle" file from the mailman2 installation. I hope that this

Re: [tcpdump-workers] Speed specific Link-Layer Header Types for USB 2.0

2022-06-14 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Tomasz Moń via tcpdump-workers wrote: >> When low-speed capture is performed, it has to be performed at the leaf >> (in graph-theory sense) connection. Full-speed traffic never make it to >> the low-speed cables, so the capture will contain only low-speed >>

Re: [tcpdump-workers] Request for new LINKTYPE_* code LINKTYPE_AUERSWALD_LOG

2021-02-03 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- developer--- via tcpdump-workers wrote: > We would like to request a dedicated LINKTYPE_* / DLT_* code. > Auerswald is a major German telecommunications equipment manufacturer. > We have implemented the option to capture (combined) network traffic > and

Re: [tcpdump-workers] Stick with Travis for continuous integration, or switch?

2021-02-03 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Francois-Xavier Le Bail via tcpdump-workers wrote: > To save CI runtime, I have committed > a063c2d21417345ee583551ef2c07a0be6b32696 for libpcap. > This will currently run only five builders (amd64, arm64, ppc64le, > s390x and osx) and do the matrix

Re: [tcpdump-workers] Request to add MCTP and PCI_DOE to PCAP link type

2021-01-25 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Yao, Jiewen wrote: > Thank you. I will file a Pull-Request. > The DOE header definition can be found > https://github.com/jyao1/openspdm/blob/master/Include/IndustryStandard/PciDoeBinding.h > It starts from PCI_DOE_DATA_OBJECT_HEADER. That sounds like

Re: [tcpdump-workers] Request to add MCTP and PCI_DOE to PCAP link type

2021-01-25 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Yao, Jiewen via tcpdump-workers wrote: > Hello Any response ? > Thank you Yao Jiewen ... Hi, sorry abotu that. > Hi I write this email to request to below 2 link types. > 1. MCTP > Management Component Transport Protocol (MCTP) is an industry

Re: [tcpdump-workers] libpcap detection and linking in tcpdump

2021-01-23 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Guy Harris via tcpdump-workers wrote: > (The existence of libtool is an indication that shared libraries have > gotten messy on UN*X.) > Perhaps for this particular case the right thing to do is to set > LD_LIBRARY_PATH when running the temporarily-installed

Re: [tcpdump-workers] libpcap detection and linking in tcpdump

2021-01-23 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Guy Harris via tcpdump-workers wrote: >> $ /tmp/libpcap/bin/pcap-config --libs -L/tmp/libpcap/lib >> -Wl,-rpath,/tmp/libpcap/lib -lpcap > So that *should* cause /tmp/libpcap/lib to be added to the executable's > path, which *should* cause it to look in

Re: [tcpdump-workers] Any way to filter ether address when type is LINUX_SLL?

2021-01-23 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Guy Harris via tcpdump-workers wrote: > I've been thinking about a world in which we have more pcapng-style > APIs. With a capture API that can deliver, for each packet, something > similar to a pcapng Enhanced Packet Block, with an interface number > from

Re: [tcpdump-workers] bpf.tcpdump.org updates

2021-01-21 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Michael Richardson via tcpdump-workers wrote: > bpf.tcpdump.org is being updated from devuan ascii (2.0) to devuan > beowolf (3.1). (Equvialent to Debian buster). > I've doing this to upgrade git to the version that supports --mirror,

[tcpdump-workers] bpf.tcpdump.org updates

2021-01-21 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- bpf.tcpdump.org is being updated from devuan ascii (2.0) to devuan beowolf (3.1). (Equvialent to Debian buster). I've doing this to upgrade git to the version that supports --mirror, which is not the right thing for the local repositories. (I was, you know, reading the man

Re: [tcpdump-workers] Any way to filter ether address when type is LINUX_SLL?

2021-01-21 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Bill Fenner via tcpdump-workers wrote: > It would be perfectly reasonable (and fairly straightforward) to update > libpcap to be able to filter on the Ethernet address in DLT_LINUX_SLL > or DLT_LINUX_SLL2 mode. There are already filters that match other >

Re: [tcpdump-workers] [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- IANA considerations

2020-12-22 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- wrote: >> -Message d'origine- >> De : OPSAWG [mailto:opsawg-boun...@ietf.org] De la part de Michael >> Richardson >> Envoyé : mardi 22 décembre 2020 17:36 >> À : Guy Harris >> Cc : Pcap-ng file format ; >> ops...@ietf.org;

Re: [tcpdump-workers] [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- FCS length description

2020-12-22 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- <#secure method=pgp mode=sign> Guy Harris wrote: > a 6-bit "extension" field, storing information about the > capture, such an indication of whether the packets include an > FCS and, if so, how many bytes of FCS are present. > So what NetBSD had was a

Re: [tcpdump-workers] [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- IANA considerations

2020-12-22 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- <#secure method=pgp mode=sign> Guy Harris wrote: >> The short of it is: >> >> 1) reserve bits 16:28 of linktype as zero. > In pcap files, presumably; you have only bits 0:15 in pcapng IDBs. Yes. That's why I changed the illustration of the packet so that

Re: [tcpdump-workers] [OPSAWG] draft-gharris-opsawg-pcap.txt --- FCS length description

2020-12-21 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Carsten Bormann wrote: > On 2020-12-22, at 01:31, Michael Richardson wrote: >> >> #define LT_FCS_LENGTH(x) (((x) & 0xF000) >> 28) >> #define LT_FCS_DATALINK_EXT(x) x) & 0xF) << 28) |

[tcpdump-workers] draft-gharris-opsawg-pcap.txt --- IANA considerations

2020-12-21 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- The short of it is: 1) reserve bits 16:28 of linktype as zero. 2) lower 32K Specification Required (any document), upper 32K First Come First Served Details: The Registry has three sections according to {{RFC8126}}: * values from 0 to 32767 are marked as

[tcpdump-workers] draft-gharris-opsawg-pcap.txt --- FCS length description

2020-12-21 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- {resend due to problems with PGP signatures vs mailman} Hi, I have reworked the document that Guy put into XML describing the *PCAP* (not NG) format. I found the text for LinkType to be confusing, and frankly, I think wrong. * LinkType (32 bits): an unsigned value

[tcpdump-workers] man pages... what's cool now? (fwd) Michael Richardson: man pages... what's cool now?

2020-12-21 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- I forgot not to PGP sign. --- End Message --- ___ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers

Re: [tcpdump-workers] pcap_open_offline_... and options and the like

2020-12-19 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Michael Richardson via tcpdump-workers wrote: > trying without GPG signature YUP. That's it. So mailman2 will have to get replaced finally. It eats emails with signature attachments, I think. This is new. After a few hours thinking about my previous email I wan

[tcpdump-workers] pcap_open_offline_... and options and the like

2020-12-19 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- trying without GPG signature {Hi, my email never made it through the list earlier. Francois' email went through earlier today, so I am at a loss as to what has happened. And other lists worked. I thought mailman was stuck, but I dunno. I backed up the list configuration,

Re: [tcpdump-workers] CVE-2020-8037: memory allocation in ppp decapsulator

2020-11-30 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Hi, CVE-2020-8037 causes a big amount of memory to be allocated (then freed), it does not cause an attack. I'm sorry that I haven't managed to succeed in doing the right CVE.json dance to get the mitre data updated. Bill Fenner via tcpdump-workers wrote: > I realize

Re: [tcpdump-workers] tcpslice licence

2020-08-21 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Denis Ovsienko via tcpdump-workers wrote: > [...] >> The first step I'd take would be to get rid of the GPLed headers in >> favor of BSD-licensed headers, e.g. taking the ip.h, tcp.h, and udp.h >> headers from tcpdump and changing the code to work with them.

Re: [tcpdump-workers] [pcap-ng-format] "Custom" link-layer types for pcap and pcapng

2020-03-27 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Guy Harris wrote: > A link-layer type value of 0x will be reserved as LINKTYPE_CUSTOM, > with libpcap offering a DLT_CUSTOM. sounds good. > A custom link-layer type has a 32-bit IANA-registered Private Enterprise Number (PEN): >

Re: [tcpdump-workers] [the-tcpdump-group/libpcap] Use tab instead of space in formatting pcap-int.h (#918)

2020-03-20 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Francois-Xavier Le Bail via tcpdump-workers wrote: >> In a github ticket, #918. > I don't see the message starting this conversation in #918, nor the > following ones. Could you push > them in the list? #918 fixes a space->tab, I think. I took it directly to

Re: [tcpdump-workers] [the-tcpdump-group/libpcap] Use tab instead of space in formatting pcap-int.h (#918)

2020-03-20 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Francois-Xavier Le Bail wrote: >> > If we do, we should replace all the tabs in pcap-int.h with spaces; we >> > should at least be consistent, and change #918 fixed one inconsistent >> > case. >> >> Let's agree that we are going towards spaces. >> I

Re: [tcpdump-workers] [the-tcpdump-group/libpcap] Use tab instead of space in formatting pcap-int.h (#918)

2020-03-19 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Guy Harris wrote: >> I thought we wanted all spaces? > If we do, we should replace all the tabs in pcap-int.h with spaces; we > should at least be consistent, and change #918 fixed one inconsistent > case. Let's agree that we are going towards spaces. I

[tcpdump-workers] snprintf in libpcap

2020-03-02 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- Back in 2016, we note in the CHANGES: Replace sprintf() with pcap_snprintf(). but, we have no prototype for this, and apparently no definition, and we use snprintf() everywhere. I'm trying to merge Ray's changes which are rebased into pull request #914. I think that we