Re: Sniffing ranges of ips

[Alexander Dupuy <dupuy () sysd com>]

Guy Harris wrote:
> Try it with the top-of-tree CVS version; I've made some optimizer fixes that
> will, I think, fix this.

I saw the commit messages.  However, I'm unable to update my CVS version; as
noted before, I get an abrupt server abort, and don't have other ideas on how
to solve this:

$ cvs -d :pserver:tcpdump () cvs tcpdump org:/tcpdump/master login
Logging in to :pserver:tcpdump () cvs tcpdump org:2401/tcpdump/master
CVS password:
cvs [login aborted]: end of file from server (consult above messages if any)

This is with the "anoncvs" password and CVS pserver config taken from the
tcpdump.org web page.  Is there some version requirement on the cvs client, or
some update to the cvs config I missed.

> I'm not sure whether that's a case of the code generator not generating code
> that uses the X register there, or a missing optimization - I have a change
> that should put that optimization back.

In any case, I loaded up from today's "dailies" and rebuilt, and the optimizer
bug appears to have been fixed since 0.8.3, but it still uses the index register:

$ ./tcpdump -? 2>&1 | grep version
tcpdump version current-cvs.tcpdump.org.2004.11.19
libpcap version current-cvs.tcpdump.org.2004.11.19
$ ./tcpdump -d 'ip[12:4] >= 0x01020304 and ip[12:4] <= 0x01020506'
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 8
(002) ld       [26]
(003) ldx      #0x1020304
(004) jge      x                jt 5    jf 8
(005) ldx      #0x1020506
(006) jgt      x                jt 8    jf 7
(007) ret      #96
(008) ret      #0

$ /usr/sbin/tcpdump -? 2>&1 | grep version
tcpdump version 3.7.2+multidlt
libpcap version 0.7+multidlt
$ /usr/sbin/tcpdump -d 'ip[12:4] >= 0x01020304 and ip[12:4] <= 0x01020506'
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 6
(002) ld       [26]
(003) jge      #0x1020304       jt 4    jf 6
(004) jgt      #0x1020506       jt 6    jf 5
(005) ret      #96
(006) ret      #0

@alex
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.