I am expecting this is a change outside of libpcap given the lack of a
note in the change log, but we are moving from Ubuntu 16.04 (well, really
12.04) to 18.04 and have starting having packets flagged for Frame Check
Sequence errors when captured and analyzed in Wireshark. I have a simple
ARP sending program for testing and have found that under Ubuntu 18.04
(libpcap version 1.8.1) an additional 14 bytes appear to be injected, with
non-zero data that is triggering the errors in the dissector (ie, if I
call pcap_inject with size argument 50, 64 bytes are captured, if called
with size argument 60, 74 are captured). On matching hardware under
Ubuntu 16.04 (libpcap 1.7.4), pcap_inject with size 50 results in 60 bytes
on the wire (expected minimum packet size) and the padding is all zeros.
Both machines are using the same Intel e1000e driver versions (3.2.6-k).
Has anyone else seen this or have a workaround?
(pcap handle is being created with pcap_open_live vs. pcap_create as this
is an older program.)
Thanks,
Steve
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
