Re: some problem in the source code

[Robert Lowe <Robert.H.Lowe () lawrence edu>]

Aman,

> But when I assign either eth0 or eth1 is working fine , I am able to 
> capture correct packets: But I fail to understand why I am getting
> corrupt packets if "any" or NULL is set (logic is I want to capture
> the packets from all of the interfaces).

The ethernet header is at the link layer; IP is at the network layer, etc.
If you're not using an ethernet interface, then the link layer header is
not guaranteed to have the same format as an ethernet header.  The packets
are not corrupt -- you just are not interpretting them correctly.  You either
write extra logic in your program to deal with each possible link layer,
or you only guarantee correct behaviour of your program when used with
ethernet interfaces.

-Robert

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.