On 2014-12-03, Mike Belopuhov <[email protected]> wrote:
> bpf aligns data following the datalink header (e.g. ethernet)
> on the BPF_ALIGNMENT boundary. Since rev1.41 of bpf.h it's
> uint32_t instead of a long. And also since then almost all
> packets become "unaligned" from the tcpdump perspective and
> require costly copies into the internal buffer. Neither IP
> header (struct ip) nor IPv6 (struct ip6_hdr) have fields
> larger than 32 bits and therefore alignment requirements for
> them are at most 32 bit.
>
> I've successfully tested this diff on sparc64 and amd64.
Oops, turns out I've had the same diff in my tree on my sparc64 for
a long time (last year?). No ill effects, but I do little tcpdumping
on that machine.
I think you have forgotten a chunk in print-atalk.c:
Index: print-atalk.c
===================================================================
RCS file: /cvs/src/usr.sbin/tcpdump/print-atalk.c,v
retrieving revision 1.27
diff -u -p -r1.27 print-atalk.c
--- print-atalk.c 14 Aug 2014 12:44:44 -0000 1.27
+++ print-atalk.c 26 Aug 2014 15:59:20 -0000
@@ -217,7 +217,7 @@ ddp_print(register const u_char *bp, reg
register u_short snet, register u_char snode, u_char skt)
{
- if ((intptr_t)bp & (sizeof(long)-1)) {
+ if ((intptr_t)bp & (sizeof(int32_t)-1)) {
static u_char *abuf = NULL;
int clen = snapend - bp;
if (clen > snaplen)
--
Christian "naddy" Weisgerber [email protected]
