On Fri, Apr 20, 2001 at 05:02:02PM +0200, Arkadiusz Miskiewicz wrote:
> My tcpdump 3.6.2 (libpcap 0.6.2) on Linux 2.4/glibc 2.2.2 system is
> doing strange thing.
>
> Filter isn't applied at beggining (or something like that) ...
> In first seconds other packets than specified at command line
> are displayed. After that small amount of time everything
> is ok and only proper packets are displayed.
It may be that, as soon as the PF_PACKET socket is opened, packets start
being delivered to it; if you have socket filter code built into your
kernel, it may be that, in the interval between the socket being opened
and the filter being attached to the socket, some packets arrive - as
there's no socket filter on the socket yet, you see all packets but, as
soon as a socket filter is attached to the socket, only packets that
match the filter show up on the socket.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
