Re: Loosing half the conversion when any BFP is

["Bill Richardson" <wrichardson () llbean com>]

From BigIP
  
tcpdump -r test.pcap -nn host 172.21.89.75 -d
(000) ldh      [12]
(001) jeq      #0x8100          jt 2    jf 14
(002) ldh      [16]
(003) jeq      #0x800           jt 4    jf 8
(004) ld       [30]
(005) jeq      #0xac15594b      jt 25   jf 6
(006) ld       [34]
(007) jeq      #0xac15594b      jt 25   jf 26
(008) jeq      #0x806           jt 10   jf 9
(009) jeq      #0x8035          jt 10   jf 26
(010) ld       [32]
(011) jeq      #0xac15594b      jt 25   jf 12
(012) ld       [42]
(013) jeq      #0xac15594b      jt 25   jf 26
(014) jeq      #0x800           jt 15   jf 19
(015) ld       [26]
(016) jeq      #0xac15594b      jt 25   jf 17
(017) ld       [30]
(018) jeq      #0xac15594b      jt 25   jf 26
(019) jeq      #0x806           jt 21   jf 20
(020) jeq      #0x8035          jt 21   jf 26
(021) ld       [28]
(022) jeq      #0xac15594b      jt 25   jf 23
(023) ld       [38]
(024) jeq      #0xac15594b      jt 25   jf 26
(025) ret      #96
(026) ret      #0

-----Original Message-----
From: tcpdump-workers-owner () lists tcpdump org
[mailto:tcpdump-workers-owner () lists tcpdump org] On Behalf Of Guy Harris
Sent: Thursday, December 20, 2007 1:31 PM
To: tcpdump-workers () lists tcpdump org
Subject: Re: [tcpdump-workers] Loosing half the conversion when any BFP
is

Bill Richardson wrote:

> With that I mind I wonder what F5 did to libpcap to get tcpdump to 
> work? They must have made some changes?

What happens if you do

        tcpdump -r test.pcap -nn host 172.21.89.75 -d

on the BigIP?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.