> I agree. Honestly I think a perfectly reasonable stance to take is
> requesting that the filters get packets *as seen on the wire/nic*. I
> think that's the mental model everyone uses, and any deviation from
> that model is prone to bugs in the kernel, libpcap, and for the enduser.
TX and RX segmentation offload also confuse matters here.
I think Linux can give libpcap large TCP fragments even when the
hardware isn't doing segmentation offload.
This also breaks the mental model.
David
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
