Bad form to reply to my own mail, I know, although the output of "tcpdump
-V" is as follows if it helps:
tcpdump version 3.9-PRE-CVS_2008_10_27
libpcap version 0.9-PRE-CVS
Thanks.
On Thu, Oct 30, 2008 at 12:33 PM, Tyson Key <[EMAIL PROTECTED]> wrote:
> Hi again, Guy. I've just been doing some strace-ing, and it appears to
> doing a "open("/dev/usbmon2", O_RDONLY|O_LARGEFILE) = 3". Not sure if the
> script log will be of use to you, although I'll attach it anyway.
> Going to try the printf() kludge soon.
>
> Tyson.
>
>
> On Thu, Oct 30, 2008 at 12:27 AM, Guy Harris <[EMAIL PROTECTED]> wrote:
>
>>
>> On Oct 29, 2008, at 1:16 PM, Tyson Key wrote:
>>
>> Also, is it considered normal for Linux 2.6.25 and above (or libpcap,
>>> although I'm not sure exactly what to blame) to truncate large numbers of
>>> USB packets? (I assume this has been hashed to death on the list in the
>>> past, though).
>>>
>>
>> Paolo? Could it be using the text interface rather than the binary
>> interface? I think I remember you indicating that the text interface
>> doesn't supply the full packet.
>>
>> Tyson, you said you were using the CVS version of libpcap (presumably
>> meaning top-of-tree CVS, the pcap-usb-linux.c of which is identical to 1.0's
>> pcap-usb-linux.c), so presumably you built it from source. You might want
>> to stick some debugging printfs into usb_activate() to see whether it uses
>> mmap access to the binary interface, non-mmap access to the binary
>> interface, or the text interface.
>>
>> -
>> This is the tcpdump-workers list.
>> Visit https://cod.sandelman.ca/ to unsubscribe.
>>
>
>
>
> --
> Fight Internet Censorship! http://www.eff.org
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Open-Source Community, and Technology Testbed: http://www.house404.co.uk/
>
--
Fight Internet Censorship! http://www.eff.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Open-Source Community, and Technology Testbed: http://www.house404.co.uk/
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
