patch for fixing truncated packets

["Aaron Turner" <synfinatic () gmail com>]

Hi all,

Not sure if this fell through the cracks last week, but I've submitted a patch:

http://sourceforge.net/tracker/index.php?func=detail&aid=1687156&group_id=53067&atid=469579

Briefly, the patch allows developers who process pcap files to
optionally increase the snaplen of
the file to work around a bug in certain broken versions of libpcap.
The result is that the all the
data which is stored in the pcap file is now accessible via the
standard libpcap API without
breaking backwards compatibility in existing programs.  You can get
background on this issue in
the "pcap_next() caplen is off by 14 bytes (L2 len)" thread from last week.

I'd appreciate some feedback so that I can plan to incorporate this
enhancement in my own code.

Thanks,
Aaron

--
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing & replay tools for Unix
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.