tcpdump mailing list archives
Re: pcap_next() caplen is off by 14 bytes (L2 len)
From: Ken Bantoft <ken () xelerance com>
Date: Mon, 2 Apr 2007 08:20:43 -0400
Re: 0.9.6 - this week.. we hit the 6 month part 2 weeks back... so I'm going to start writing all the ChangeLog/Notes, and get it shipped.
Ken On 2-Apr-07, at 1:35 AM, Aaron Turner wrote:
On 4/1/07, Guy Harris <guy () alum mit edu> wrote:I've checked into the main and x.9 branches a change that sets thepcap_t's snaplen value to 14 more than the value from the file header if the capture was an Ethernet capture with the modified libpcap (based onthe magic number). This isn't ideal - I'd like to do it only if thecapture was done in cooked mode - but there's no easy way to determine whether it was a cooked-mode capture or not, so, while that means that a raw-mode Ethernet capture will appear to have a snapshot length 14 morethan the real snapshot, that's probably the best we can do. That modified libpcap hasn't, as far as I know, been in any Linux distribution for a while, so there shouldn't be many *more* of those files showing up.Thanks for looking into this more and coming up with a fix. Is there an ETA for 0.9.6 (which I assume will have this fix?) Thanks, Aaron - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Re: pcap_next() caplen is off by 14 bytes (L2 len) Guy Harris (Apr 01)
- Re: pcap_next() caplen is off by 14 bytes (L2 len) Aaron Turner (Apr 01)
- Re: pcap_next() caplen is off by 14 bytes (L2 len) Ken Bantoft (Apr 02)
- Re: pcap_next() caplen is off by 14 bytes (L2 len) Aaron Turner (Apr 01)