Package: libpcap0.8
Version: 1.0.0-1
Linux kernel 2.6.29-rc6, x86_64, but 32-bit userland. It seems to
work on 32/32 and 64/64-bit machines.
Running tcpdump:
# tcpdump -n -i cable
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on cable, link-type EN10MB (Ethernet), capture size 96 bytes
11:22:26.1235573909 c8:b9:c1:d5:00:0e > 00:00:00:00:00:80, ethertype Unknown
(0x9bb1), length 0:
0x0000: e4ce 0800 4500 0030 ee36 4000 7206 63b0 [email protected].
0x0010: c892 d491 4729 d293 f4d2 0019 37d2 fcf9 ....G)......7...
0x0020: 0000 0000 7002 ffff a326 0000 0204 0514 ....p....&......
11:22:26.1235573909 9b:b1:e4:ce:00:80 > 00:00:00:00:00:0e, ethertype Unknown
(0xc8b9), length 0:
0x0000: c1d5 0800 4500 0030 0000 4000 4006 83e7 ....e.....@.@...
0x0010: 4729 d293 c892 d491 0019 f4d2 3feb c254 G)..........?..T
0x0020: 37d2 fcfa 7012 16d0 8965 0000 0204 05b4 7...p....e......
11:22:26.1235573909 IP 68.180.219.142.80 > 71.41.210.146.13609: . ack
1071338707 win 33218 <nop,nop,timestamp 2487453344 4225053>
tcpdump: pcap_loop: corrupted frame on kernel ring mac offset 94 + caplen 96 >
frame len 160
3 packets captured
5 packets received by filter
0 packets dropped by kernel
# dpkg -i libpcap0.8*_0.9.8-5_i386.deb
dpkg - warning: downgrading libpcap0.8-dev from 1.0.0-1 to 0.9.8-5.
(Reading database ... 212328 files and directories currently installed.)
Preparing to replace libpcap0.8-dev 1.0.0-1 (using
libpcap0.8-dev_0.9.8-5_i386.deb) ...
Unpacking replacement libpcap0.8-dev ...
dpkg - warning: downgrading libpcap0.8 from 1.0.0-1 to 0.9.8-5.
Preparing to replace libpcap0.8 1.0.0-1 (using libpcap0.8_0.9.8-5_i386.deb) ...
Unpacking replacement libpcap0.8 ...
Setting up libpcap0.8 (0.9.8-5) ...
Setting up libpcap0.8-dev (0.9.8-5) ...
Processing triggers for man-db ...
# # !tcpdump
tcpdump -n -i cable
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on cable, link-type EN10MB (Ethernet), capture size 96 bytes
10:02:43.843339 IP 92.80.168.111.64752 > 71.41.210.147.25: . ack 773841926 win
6144
10:02:43.916592 IP 201.236.130.184.58205 > 71.41.210.147.25: . ack 768365065
win 17640
10:02:43.949386 IP 71.41.210.146.59221 > 65.32.1.70.53: 26912+ [1au] TXT?
77.186.83.200.bl.spamcop.net. (57)
10:02:43.959008 IP 125.164.236.249.16298 > 71.41.210.147.25: P
3132997246:3132997286(40) ack 421228640 win 65495
10:02:43.959035 IP 71.41.210.147.25 > 125.164.236.249.16298: P 1:21(20) ack 40
win 5840
10:02:43.991352 IP 65.32.1.70.53 > 71.41.210.146.59221: 26912 1/8/6 (376)
10:02:43.998161 IP 200.13.236.227.2433 > 71.41.210.147.25: S
2838707294:2838707294(0) win 16384 <mss 1460,nop,nop,sackOK>
10:02:44.025332 IP 84.184.248.131.1897 > 71.41.210.147.25: P
3659107875:3659108126(251) ack 369670045 win 31738
And oh, look, I'm getting my usual spam. I had to downgrade tcpdump to
3.9.8-4 to use the older libpcap, but that's the version used for both
of the above examples.
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
