I agree.
I had the same problem in the first versions of winpcap: when the frequency
of the packets was high, the filter lost some packets at the beginning of
the capture.
I corrected it setting the filter *before* the driver starts receiving the
packets from the adapter.
Loris.
> On Fri, Apr 20, 2001 at 05:02:02PM +0200, Arkadiusz Miskiewicz wrote:
> > My tcpdump 3.6.2 (libpcap 0.6.2) on Linux 2.4/glibc 2.2.2 system is
> > doing strange thing.
> >
> > Filter isn't applied at beggining (or something like that) ...
> > In first seconds other packets than specified at command line
> > are displayed. After that small amount of time everything
> > is ok and only proper packets are displayed.
>
> It may be that, as soon as the PF_PACKET socket is opened, packets start
> being delivered to it; if you have socket filter code built into your
> kernel, it may be that, in the interval between the socket being opened
> and the filter being attached to the socket, some packets arrive - as
> there's no socket filter on the socket yet, you see all packets but, as
> soon as a socket filter is attached to the socket, only packets that
> match the filter show up on the socket.
> -
> This is the TCPDUMP workers list. It is archived at
> http://www.tcpdump.org/lists/workers/index.html
> To unsubscribe use
mailto:[EMAIL PROTECTED]?body=unsubscribe
>
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
