tcpdump mailing list archives
pcap_inject change?
From: Steve Bourland <sbourland () swri edu>
Date: Tue, 11 Sep 2018 11:38:56 -0500 (CDT)
I am expecting this is a change outside of libpcap given the lack of a note in the change log, but we are moving from Ubuntu 16.04 (well, really 12.04) to 18.04 and have starting having packets flagged for Frame Check Sequence errors when captured and analyzed in Wireshark. I have a simple ARP sending program for testing and have found that under Ubuntu 18.04 (libpcap version 1.8.1) an additional 14 bytes appear to be injected, with non-zero data that is triggering the errors in the dissector (ie, if I call pcap_inject with size argument 50, 64 bytes are captured, if called with size argument 60, 74 are captured). On matching hardware under Ubuntu 16.04 (libpcap 1.7.4), pcap_inject with size 50 results in 60 bytes on the wire (expected minimum packet size) and the padding is all zeros. Both machines are using the same Intel e1000e driver versions (3.2.6-k).
Has anyone else seen this or have a workaround?(pcap handle is being created with pcap_open_live vs. pcap_create as this is an older program.)
Thanks, Steve _______________________________________________ tcpdump-workers mailing list tcpdump-workers () lists tcpdump org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
Current thread:
- pcap_inject change? Steve Bourland (Sep 11)
- Message not available
- Re: pcap_inject change? Steve Bourland (Sep 11)
- Message not available
- Re: pcap_inject change? Steve Bourland (Sep 11)
- Re: pcap_inject change? Michael Richardson (Sep 11)
- Re: pcap_inject change? Steve Bourland (Sep 11)
- Message not available
- Re: pcap_inject change? Steve Bourland (Sep 11)