> -- this is the ATM cell header size, right?
Yup.
If it's an ATM cell header, it'd be
GFC: 0
VPI: 0x8
VCI: 0x0023 = 35
PT: 001
CLP: 0
HEC: 0xec
> My guess is that the kernel is making a mistake when
> copying the packet to the packet filter.
Probably. I've seen various problems with captures on Linux, at least
some of which are, I suspect, the result of improper handling of
outgoing packets (the code path is a bit weird - outgoing packets seem
to get sent off to "network tap" sockets when the packet is queued up
for transmission, but it may be that the packet isn't "finished" and
whatever code actually transmits it finishes processing it).
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
