----- Original Message -----
From: "Guy Harris" <[EMAIL PROTECTED]>
To: "Bill Fenner" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>;
<[EMAIL PROTECTED]>
Sent: Monday, April 23, 2001 10:07 PM
Subject: Re: Re: [tcpdump-workers] tcpdump with PPPoATM/Strange output
> > -- this is the ATM cell header size, right?
Yes, I saw also that. 5 is certainly ATM header size.
It means the bug is rather in ATM code somewehre.
But !!!!!! Somes outgoing packet are correctly interpreted with Tcpdump.
Its a lot worse for kernel!!!!!!!
St Palka
>
> Yup.
>
> If it's an ATM cell header, it'd be
>
> GFC: 0
> VPI: 0x8
> VCI: 0x0023 = 35
> PT: 001
> CLP: 0
> HEC: 0xec
>
> > My guess is that the kernel is making a mistake when
> > copying the packet to the packet filter.
>
> Probably. I've seen various problems with captures on Linux, at least
> some of which are, I suspect, the result of improper handling of
> outgoing packets (the code path is a bit weird - outgoing packets seem
> to get sent off to "network tap" sockets when the packet is queued up
> for transmission, but it may be that the packet isn't "finished" and
> whatever code actually transmits it finishes processing it).
>
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
