On Mar 22, 2011, at 8:47 PM, [email protected] wrote: > From: Julien Moutinho <[email protected]> > > Symptom is a capture where caplen < len <= snaplen. > For instance to reproduce: > % sudo tcpdump -U -w /tmp/lo.pcap -s 128 -i lo -n ip & > tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 128 > bytes > % ping -c 1 -s $((-20-8+128)) 127.0.0.1 > % tshark -r /tmp/lo.pcap -V -T text -n | grep '^Frame ' > Frame 1 (142 bytes on wire, 122 bytes captured) > Frame 2 (142 bytes on wire, 122 bytes captured) > here there should have been 128 bytes captured.
Checked in to the trunk and 1.1 branches. (Wow, that's unfortunate. Does the turbopacket stuff really make it *that* complicated to just request a precise snapshot length, including requiring you to attempt to match in userland what the kernel is doing - and hope the kernel hasn't changed what it does?) - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
