> pcap-bpf silently ignores failures to put the interface in promiscuous
> mode. I was trying to dump on an interface that doesn't support promiscuous
> mode (a FreeBSD 802.1Q VLAN sub-interface), but I wasn't aware of that
> fact, and was confused by the fact that I wasn't seeing everything.
>
> I understand not wanting it to be a fatal error, but I'd like to know
> about it. What do people think about making ebuf always valid, whether
> pcap_open_live() returns NULL or not, and if ebuf is full but
> pcap_open_live() also succeeded then it's a warning?
I think that would be an excellent idea.
Note that any application using this should clear the buffer it passes
to "pcap_open_live()" first, so that it'll work with current versions of
libpcap and not report as a warning whatever stuff happens to be in that
buffer.
Given that, should we require all the "pcap_open_live()" routines to
clear the buffer first, or should we explicitly document the requirement
that the buffer be cleared first if the application is going to check
the buffer even if "pcap_open_live()" succeeds?
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
