The fact that you sent mail to "[EMAIL PROTECTED]" suggests that you
may be using an old version of libpcap. The LBL folks aren't
maintaining tcpdump or libpcap any more; tcpdump.org is now doing that,
and their mailing lists are being forwarded to
[EMAIL PROTECTED]
> I just ran into a problem with pcap-snoop.c on a SG platform in the line "if
> (ioctl(fd, SIOCSNOOPLEN, &snaplen) < 0) {". I have a fix that seems to
> work, at least for my purposes, but I thought you might like to know.
>
> With an MTU of 1500, if snaplen is set at 1518 (1500 plus the Ethernet
> header size), the ioctl fails because the size is invalid, while if snaplen
> is set at 1500, pcap doesn't get the complete packet with maximum-size
> packets. If I have things figured out right, the ioctl wants a size without
> the Ethernet header while other code in pcap needs the size including the
> Ethernet header. I modified pcap-snoop.c to create a local variable set to
> snaplen - 18 and pass that to the ioctl, and that seems to solve the problem
> although I haven't done a lot of testing.
We (tcpdump.org) fixed that a while ago; we now subtract the link-layer
header length from the specified snapshot length before passing it to
the SIOCSNOOPLEN ioctl.
Download the 0.6.2 libpcap (or the 0.7 beta) and try that.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
