From BigIP tcpdump -r test.pcap -nn host 172.21.89.75 -d (000) ldh [12] (001) jeq #0x8100 jt 2 jf 14 (002) ldh [16] (003) jeq #0x800 jt 4 jf 8 (004) ld [30] (005) jeq #0xac15594b jt 25 jf 6 (006) ld [34] (007) jeq #0xac15594b jt 25 jf 26 (008) jeq #0x806 jt 10 jf 9 (009) jeq #0x8035 jt 10 jf 26 (010) ld [32] (011) jeq #0xac15594b jt 25 jf 12 (012) ld [42] (013) jeq #0xac15594b jt 25 jf 26 (014) jeq #0x800 jt 15 jf 19 (015) ld [26] (016) jeq #0xac15594b jt 25 jf 17 (017) ld [30] (018) jeq #0xac15594b jt 25 jf 26 (019) jeq #0x806 jt 21 jf 20 (020) jeq #0x8035 jt 21 jf 26 (021) ld [28] (022) jeq #0xac15594b jt 25 jf 23 (023) ld [38] (024) jeq #0xac15594b jt 25 jf 26 (025) ret #96 (026) ret #0
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Guy Harris Sent: Thursday, December 20, 2007 1:31 PM To: [email protected] Subject: Re: [tcpdump-workers] Loosing half the conversion when any BFP is Bill Richardson wrote: > With that I mind I wonder what F5 did to libpcap to get tcpdump to > work? They must have made some changes? What happens if you do tcpdump -r test.pcap -nn host 172.21.89.75 -d on the BigIP? - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
