Re: "not vlan" filter expression brokencatastrophically!

["David Laight" <David.Laight () ACULAB COM>]

> I agree. Honestly I think a perfectly reasonable stance to take is
> requesting that the filters get packets *as seen on the wire/nic*. I
> think that's the mental model everyone uses, and any deviation from
> that model is prone to bugs in the kernel, libpcap, and for the enduser.

TX and RX segmentation offload also confuse matters here.
I think Linux can give libpcap large TCP fragments even when the
hardware isn't doing segmentation offload.
This also breaks the mental model.

        David



_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers