Thanks for help, i didn't solve the problem but i'll try to test it on eth.
> On what OS? (I assume it's probably either some Linux distribution or
> some flavor of BSD - or *maybe* Digital UNIX, although I don't remember
> whether I got it to work there or not - as, on at least some other OSes,
> you can't capture on the loopback device.)
It's Linux Mandrake 7.2
> The callback routine for "pcap_loop()" is passed data for a packet, so
> if it's called four times for every packet, presumably one of those
> times you get the actual packet data - what is it getting passed on the
> other three calls? (Note that on Linux, versions of libpcap prior to
> 0.6 supplied two copies of every packet sent over the loopback
> interface, due to the way the loopback interface code works; libpcap 0.6
> and later throw away one of those copies, so you see only one copy.)
I get four copies of the same packet - I think the problem is in the way
loopback works, as you wrote.
Sorry for this "strange behaviour - 65535", it was my fault, just variable
range problem :)
But I have one more question. What is the (u_char* user) variable for? It
appears in few functions but it isn't documented in manual. There is no word
about that. I think it isn;t important for me but i'd like to know. Maybe you
will fix the documentation :)
thanks
Sebastian Proba
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
