Re: [BUG] pcap-usb-linux.c

[Guy Harris <guy () alum mit edu>]

On Oct 29, 2008, at 7:38 PM, Jean-Louis wrote:

> in accordance with usbmon.txt in "mmap mode" the data is at
>
> &mmap_area[vec[i]] + 64;
>
> rather than
>
> &mmap_area[vec[i]] + 48;
>
> with mmap ther'is 16Byte filled with 0 first to the real data...
>
> so if i.e. I have caplen = 18Byte, in file.pcap I have 16Byte with  
> garbage (0x00) and only 2Byte with real data other 16Byte of real  
> data is lost.
>
> the mmap mode is *default* with kernel >= 2.6.25-rc8-mm1
>
> I'm newbie with libpcap and I don't know how I can fix that without  
> degrading performance

The only way to fix that without doing a lot of copying would be to  
add a new DLT_ value for Linux mmapped access, with the USB header  
defined to include the padding (and change apps that handle USB  
captures to handle the new DLT_ value). 
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.