Actually, there's interleaved data here.
On Sat, Apr 21, 2001 at 08:35:41PM +0200, Palka Stanislaw wrote:
> > 0800 100: bad-hlen 0
> 0040 0040 0110 41c3 24d2 1dc3 24d2 0108
> 00f8 e28a 0301 00ae cfe1 3aec 0b0d 0008
> 090a 0b0c 0d0e 0f10 1100 8002 32ec 1213
> 1415 1617
> < 0800 100: 195.36.210.1 > 195.36.210.29: icmp: echo reply (DF)
> 4500 0054 2988 4000 4001 e6b8 c324 d201
> c324 d21d 0000 00e3 8a03 0100 aecf e13a
> ec0b 0d00 0809 0a0b 0c0d 0e0f 1011 1213
> 1415 1617
If you shift the first packet around a little, you
get
00 4000 4001 1041 c324 d21d
c324 d201 0800 f8e2 8a03 0100 aecf e13a
ec0b 0d00 0809 0a0b 0c0d 0e0f 1011 00 8002 32ec 1213
1415 1617
Which has a lot more in common with the echo reply.
Note that there are 5 missing bytes from the
beginning, and after 41 bytes there are 5 inserted
bytes -- this is the ATM cell header size, right?
My guess is that the kernel is making a mistake when
copying the packet to the packet filter.
Bill
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
