On Tue, Apr 16, 2002 at 04:00:35PM -0400, Michael Gray wrote: > I even resorted to dumping the packet in pcap_read, > before the callback, and it was the same thing.
So presumably you also see this problem with tcpdump or Ethereal as well, right? (Use "-s 65535" with tcpdump, so you capture enough of the packet data to see the problem.) You might first try using the current CVS version of libpcap, to see if that makes a difference; there was a DLPI problem that was fixed subsequent to the release of 0.7.1, although I wouldn't expect that to be a problem. If that doesn't clear the problem up, it might be interesting to see whether a raw DLPI application sees it as well, in which case it's probably a problem in the Solaris kernel - either the streams code, or the DLPI code, or the network card driver. Unfortunately, I don't know where Neal Nuckolls' stuff on DLPI, including some sample code, can be found any more (some Web sites speak of it being on opcom.sun.ca, but that site's not responding right now; I don't know if it's gone, or just unavailable right now). I have some copies of it from a while ago, which I could send you. I'd be surprised if DLPI were *completely* broken, however, as it's what was, at least at one point, used as the interface between network protocols and device drivers, so if it were completely broken I'd also expect relatively infrequently used stuff such as IP not to work right either. :-) - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
