Hello!
When tcpdump receives UDP packets with the udp-len field < 8 than
a big (usually near to 2^32) data len is reported.
This is the code:
(void)printf(" udp %u",
(u_int32_t)(ulen - sizeof(*up)));
Maybe it's better to use a signed type, it seems better to se -8 instead of
(2^32)-8, or a format like the following:
udp (<8 [ulen])
if (ulen >= 8) {
(void)printf(" udp %u",
(u_int32_t)(ulen - sizeof(*up)));
} else {
(void)printf(" udp (<8 %u)", (u_int32_t) ulen);
}
This may break applications that works using the tcpdump output
(that now are getting anyway a wrong len).
I'm not subscribed, please CC me.
Thanks for www.tcpdump.org and for your work.
regards,
antirez
--
Salvatore Sanfilippo | <[EMAIL PROTECTED]>
http://www.kyuzz.org/antirez | PGP: finger [EMAIL PROTECTED]
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
