Guy Harris ha scritto:
On Oct 29, 2008, at 7:38 PM, Jean-Louis wrote:
in accordance with usbmon.txt in "mmap mode" the data is at
&mmap_area[vec[i]] + 64;
rather than
&mmap_area[vec[i]] + 48;
with mmap ther'is 16Byte filled with 0 first to the real data...
so if i.e. I have caplen = 18Byte, in file.pcap I have 16Byte with
garbage (0x00) and only 2Byte with real data other 16Byte of real
data is lost.
the mmap mode is *default* with kernel >= 2.6.25-rc8-mm1
I'm newbie with libpcap and I don't know how I can fix that without
degrading performance
The only way to fix that without doing a lot of copying would be to
add a new DLT_ value for Linux mmapped access, with the USB header
defined to include the padding (and change apps that handle USB
captures to handle the new DLT_ value).-
this means request a new DLT_ value like i.e. DLT_USB_LINUX_MMAPPED, add
a new struct in libpcap/pcap/usb.h similar to pcap_usb_header with last
field for padding i.e.
typedef struct _usb_header_mmapped {
...
...
u_int8_t padding[16];
} pcap_usb_header_mmapped;
change pcap-usb-linux.c for use new DLT_USB_LINUX_MMAPPED and new
pcap_usb_header_mmapped for mmapped access, while text access and bin
access use "standard" DLT_USB_LINUX and pcap_usb_header
find -name "*.[ch]" | xargs grep "_USB_LINUX"
find -name "*.[ch]" | xargs grep "pcap_usb_header"
changing file accordingly:
gencode.c
pcap.c
savefile.c
pcap-usb-linux.c
pcap/usb.h
pcap/bpf.h
it's correct?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
