Re: [tcpdump-workers] Minor linux radiotap patch

2005-08-15 Thread Guy Harris
Mike Kershaw wrote: No, it's the next in line, and madwifi uses it as well for radiotap on linux. OK, I've checked the patch into the main and x.9 branches. - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] user provided packet buffer

2005-08-15 Thread Stephen Donnelly
On Mon, 2005-08-15 at 13:31 -0500, Randy Smith wrote: > Hello, > > I'm using libpcap to capture packets, but by default the packets are > stored in a buffer allocated "inside" the pcap library (e.g., the > "buffer" pointer of the pcap_t struct). > > Does the pcap library provide any API's that

Re: [tcpdump-workers] Minor linux radiotap patch

2005-08-15 Thread Mike Kershaw
> >This isn't yet an official arphrd, but madwifi also uses it for radiotap > >output on linux and I expect we'll have it official soon. If you'd > >rather wait before merging, let me know and I'll post it again once the > >arphrd is officially ours. > > Do you have any reason to believe that the

[tcpdump-workers] user provided packet buffer

2005-08-15 Thread Randy Smith
Hello, I'm using libpcap to capture packets, but by default the packets are stored in a buffer allocated "inside" the pcap library (e.g., the "buffer" pointer of the pcap_t struct). Does the pcap library provide any API's that allow the user to specify his/her own pcap_pkthdr buffer and capt

Re: [tcpdump-workers] Pings fail unless tcpdump is watching both

2005-08-15 Thread Burton Strauss
One odd thought from having read some of the driver code chasing something else - if you have multiple IPs assigned to a NIC, SOME drivers invisibly put the NIC into promiscuous mode (so they can do the multiple-ip filtering) and do not report same to the kernel. Result: ifconfig shows it NOT in p

[tcpdump-workers] Radio headers and snapshot lengths

2005-08-15 Thread Guy Harris
Speaking of radiotap, the current tcpdump snapshot length defaults of 68 (for tcpdump without IPv6 support) and 96 (for tcpdump with IPv6 support) don't correspond to the same amount of payload above the "link layer" on all network types. For most network types, the difference is small - if we

Re: [tcpdump-workers] Minor linux radiotap patch

2005-08-15 Thread Guy Harris
Mike Kershaw wrote: Since I'm working more on pushing the radiotap patches into the kernel, heres a super-tiny patch to libpcap to properly detect the link type. This isn't yet an official arphrd, but madwifi also uses it for radiotap output on linux and I expect we'll have it official soon. If

Re: [tcpdump-workers] Pings fail unless tcpdump is watching both

2005-08-15 Thread Cian Masterson
Gianluca Varenni wrote: - Original Message - From: "Guy Harris" <[EMAIL PROTECTED]> To: Sent: Friday, August 12, 2005 10:25 AM Subject: Re: [tcpdump-workers] Pings fail unless tcpdump is watching both Cian Masterson wrote: Can anyone tell me what changes/hooks tcpdump puts into the