tcpdump mailing list archives
libpcap question.
From: Matt Comb <mattyc () orcon net nz>
Date: 13 May 2003 17:37:43 +0000
Hi, these questions are more related to libpcap but i wonder if someone can help me. I am currently using libpcap to sniff a connection. When I transfer an ftp sequence on a very fast lan, It seems that I am losing packets. I am not sure that I have the libpcap buffer size set correctly, my questions are as follows. 1. When I was using tcpdump, i set the packet size to 1514 so I received the entire packet. I have set the snaplen in libpcap to this value and i am calling getnext is this correct? 2. Should I be setting a different operating buffer for libpcap after the open live, and if so how? 3. Or should I have snaplen much higher and then potentially get more than one packet when i call getnext? I'm a slightly confused about the correct way to make sure that I am grabbing all and full packets. Any help would be appreciated. Matt. p.s. is there a libpcap mailing list?
Current thread:
- tcpdump reassembly (imp) Vaidehi Kasarekar (May 01)
- Re: tcpdump reassembly (imp) Steve Bonds (May 01)
- libpcap question. Matt Comb (May 13)