Re: pcap_next() caplen is off by 14 bytes (L2 len)

[Ken Bantoft <ken () xelerance com>]

Re:  0.9.6 - this week.. we hit the 6 month part 2 weeks back... so  
I'm going to start writing all the ChangeLog/Notes, and get it shipped.

Ken

On 2-Apr-07, at 1:35 AM, Aaron Turner wrote:

> On 4/1/07, Guy Harris <guy () alum mit edu> wrote:
>
> > I've checked into the main and x.9 branches a change that sets the
> > pcap_t's snaplen value to 14 more than the value from the file  
> > header if
> > the capture was an Ethernet capture with the modified libpcap  
> > (based on
> > the magic number).  This isn't ideal - I'd like to do it only if the
> > capture was done in cooked mode - but there's no easy way to  
> > determine
> > whether it was a cooked-mode capture or not, so, while that means  
> > that a
> > raw-mode Ethernet capture will appear to have a snapshot length 14  
> > more
> > than the real snapshot, that's probably the best we can do.  That
> > modified libpcap hasn't, as far as I know, been in any Linux
> > distribution for a while, so there shouldn't be many *more* of those
> > files showing up.
>
>
> Thanks for looking into this more and coming up with a fix.  Is there
> an ETA for 0.9.6 (which I assume will have this fix?)
>
> Thanks,
> Aaron
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.