On Tue, May 05, 2015 at 04:39:51PM +0200, Daniel Borkmann wrote: > On 05/05/2015 12:10 PM, Daniel Borkmann wrote: > >On 05/05/2015 11:26 AM, Tobias Klauser wrote: > >>On 2015-05-02 at 22:54:50 +0200, Vadim Kochan <vadi...@gmail.com> wrote: > >>>On Sat, May 02, 2015 at 07:00:53PM +0200, Tobias Klauser wrote: > >>>>On 2015-04-29 at 21:18:24 +0200, Vadim Kochan <vadi...@gmail.com> wrote: > >>>>>From: Vadim Kochan <vadi...@gmail.com> > >>>>> > >>>>>It might be related to the issue #73 noticed by > >>>>> > >>>>> Jon Schipp <jonsch...@gmail.com> > >>>>> > >>>>>where he pointed that netsniff-ng captures some extra packets. > >>>>> > >>>>>I observed this issue when I captured few Ethernet frames from > >>>>>wireless device while I was sniffing Netlink monitor device (!!!), > >>>>>especially under high load traffic (HD Video). > ... > >The better fix would just be to consolidate pf_socket() and pf_tx_socket() > >and allocate both with socket(PF_PACKET, SOCK_RAW, 0). That way, we > >should also be able to avoid the synchronize_net() barrier (as po->running > >is false at bind time). > > > >If we change pf_socket(), the only thing we need to make sure is that > >all such sockets do a proper bind() call before starting to capture > >packets, so that we don't break anything. > > Vadim, feel free to follow-up on that with a fix based on above suggestion, > as you've already investigated and proposed a first patch. > > Thanks, > Daniel
Will play with this today :) When I was investigating this I really tried to use 0 instead of ETH_P_ALL but for some reason I did not catch any packets and dropped this way, and after your explanation I tried again and saw some packets at least. OK I will try what I can do. Thanks, -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
