Guy Harris <guy <at> alum.mit.edu> writes: > You probably need a newer kernel. The original ring buffer mechanism didn't work if the userland code isn't > the same bit width as the kernel code, because "struct tpacket_hdr" has an "unsigned long" member, which > means the structure's layout differs between 32-bit and 64-bit. Somewhere between 2.6.18.2 and > 2.6.27.9, a second structure, all of whose fields are __u32 or __u16 and thus the same in 32-bit and 64-bit > mode, was added, so that users of the ring buffer mechanism can either get the old structure by default or > can select the new header. > > If the new header is available, libpcap will use it.
Ok, thanks. I just checked all the environments that "work" (as per QA), and sure enough, they don't... The same OS on an Intel machine fails with the same problem. I then compared the header files on those machines and my development machine and saw the difference, like you said. Great help, thank you very much. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
