This arose on the ntop mailing list, and I tracked it down to gen_broadcast
in libpcap. The problem arises with a promiscuous NIC listening to an
overlaid network (where the packets seen include addresses outside the
NIC's configured subnet).
Executive summary: gen_broadcast(ETHERNET_IP) should include a term that
matches the network part of the address to that of the interface.
<http://listgateway.unipi.it/pipermail/ntop/2005-June/010550.html>
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
