Guy Harris <guy <at> alum.mit.edu> writes: > > some printout I could add before calling pcap_dispatch to see what's in the > > kernel buffer and what in the userland buffer? > > Yes, but you'd have to add it to libpcap. > > >> Is your program built as a 32-bit program or a 64-bit program? > >
To summarize, the "lipo -info lipo -i /usr/sbin/tcpdump" command reports as expected: Architectures in the fat file: /usr/sbin/tcpdump are: x86_64 i386 Executed on tcpdump recompiled by me on the same machine using makefile: Non-fat file: tcpdump is architecture: x86_64 I recompiled the test application "inspector" (which uses lipcap to capture) for architecture i386, and no packets were delivered by libpcap. I recompiled for x86_64, now I get: Non-fat file: inspector is architecture: x86_64 But the problem is still the same. I am compiling with Xcode 3.2.1, gcc version is 4.2.1. The project is generated by cmake, and the build default arhitecture is i386. I also tried generating the Makefile with cmake and use to compile the application, but without benefit. I also tried changing snaplen wih high and low values, timeout values greater than 1000, promisc mode on/off, etc. None of these changes seem to modify the behaviour except the aforementioned pcap_set_buffer_size(128). - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
