On Oct 29, 2008, at 1:16 PM, Tyson Key wrote:
Also, is it considered normal for Linux 2.6.25 and above (or libpcap,
although I'm not sure exactly what to blame) to truncate large
numbers of
USB packets? (I assume this has been hashed to death on the list in
the
past, though).
Paolo? Could it be using the text interface rather than the binary
interface? I think I remember you indicating that the text interface
doesn't supply the full packet.
Tyson, you said you were using the CVS version of libpcap (presumably
meaning top-of-tree CVS, the pcap-usb-linux.c of which is identical to
1.0's pcap-usb-linux.c), so presumably you built it from source. You
might want to stick some debugging printfs into usb_activate() to see
whether it uses mmap access to the binary interface, non-mmap access
to the binary interface, or the text interface.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.