Re: [tcpdump-workers] tcpdump problem

[Mercia Eliane Bittencourt Figueredo]

Hello,
At 18:19 22/09/01 -0700, you wrote:
>On Sat, Sep 22, 2001 at 09:10:07PM -0300, Mercia Eliane Bittencourt
Figueredo wrote:
>> [root@gandalf ~]# tcpdump -e -i atm0 | more
>> tcpdump: listening on atm0
>> 20:02:46.800000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
>> rx type 0 (512) (DF)
>
>Congratulations!  You've managed to find *two separate* bugs in
>tcpdump's "cip_print()" routine!
 :)

>Bug 1:
>
>       it decides whether to print the LLC header or "null
>       encap[sulation]" by comparing the first 6 bytes of the frame
>       with the first 6 bytes of an LLC+SNAP header - and prints the
>       LLC header if they're *not* equal, i.e. if there's a null
>       encapsulation.
>
>Bug 2:
>
>       it appears to think that "etherproto_string()" prints something,
>       rather than just returning a string to be printed.
>
>So it appears that, for whatever reason, the LLC header is being
>stripped off - which means that it'd better not report any non-IP
>traffic.
>
>Does the ATM support - including the driver for the ATM card on your
>machine (what type of ATM card is it?) - come with the kernel you're
>running, or did you have to add stuff from the "ATM on Linux" site?

I am working with Forerunner LE 25( IDT driver), Forerunner LE 155(IDT
driver) and ForerunnerHE 155(Chas Willian driver
:ftp://ftp.cmf.nrl.navy.mil/pub/chas/linux-atm/)
The linux kernel is linux-2.4.9-ac5 and it has the IDT driver and I am
working with atm-0.78.tar.gz from "ATM on linux" site

>> >Unless there's some way for libpcap to determine, for a device, whether
>> >it show an 802.2 header on snooped packets, we may have to treat this as
>> >yet another Linux link-layer type that can only be sanely snooped in
>> >cooked mode.
>> >
>> How Can I do it?
>
>You'd have to modify the "pcap-linux.c" file with the attached patch,
>rebuild libpcap, and rebuild tcpdump.

I am going to do it...

Thanks
Mercia

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe