On Jul 12, 2018, at 11:33 AM, Petr Vorel <pvo...@suse.cz> wrote:

> +#ifdef PCAP_SUPPORT_SLL_V2
> +     char ifname[IF_NAMESIZE];
> +     if (if_indextoname(EXTRACT_BE_U_6(sllp->sll_ifindex), ifname))
> +             ND_PRINT("IFNAME %s ", ifname);
> +#endif

What happens if you capture traffic on machine A and print it on machine B, 
where machines A and B have different sets of network interfaces?

(This is why pcapng has Interface Description Blocks - so that the list of 
interfaces is part of the file, so you use *that*, rather than the 
configuration of interfaces on the machine running the program reading the 
capture, to get interface names.)

Perhaps this should be done *only* for live captures, *not* for reading 
savefiles.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers

Reply via email to