tcpdump mailing list archives

Re: [PATCH 1/2] Fix: pcap-linux.c: create_ring(): calibrate req.tp_frame_size as in tpacket_rcv() (almost).

From: Guy Harris <guy () alum mit edu>
Date: Tue, 22 Mar 2011 23:58:57 -0700


On Mar 22, 2011, at 8:47 PM, julm+tcpdump () savines alpes fr eu org wrote:

From: Julien Moutinho <julm () savines alpes fr eu org>

Symptom is a capture where caplen < len <= snaplen.
For instance to reproduce:
      % sudo tcpdump -U -w /tmp/lo.pcap -s 128 -i lo -n ip &
      tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 128 bytes
      % ping -c 1 -s $((-20-8+128)) 127.0.0.1
      % tshark -r /tmp/lo.pcap -V -T text -n | grep '^Frame '
      Frame 1 (142 bytes on wire, 122 bytes captured)
      Frame 2 (142 bytes on wire, 122 bytes captured)
here there should have been 128 bytes captured.


Checked in to the trunk and 1.1 branches.

(Wow, that's unfortunate.  Does the turbopacket stuff really make it *that* complicated to just request a precise 
snapshot length, including requiring you to attempt to match in userland what the kernel is doing - and hope the kernel 
hasn't changed what it does?)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.

Current thread:

[bug] [libpcap] pcap-linux.c: PACKET_MMAP: caplen < len <= snaplen. julm+tcpdump (Mar 22)
- [PATCH 1/2] Fix: pcap-linux.c: create_ring(): calibrate req.tp_frame_size as in tpacket_rcv() (almost). julm+tcpdump (Mar 22)
  - [PATCH 2/2] Debug: pcap-linux.c: fprintf() values related to req.tp_frame_size. julm+tcpdump (Mar 22)
  - Re: [PATCH 1/2] Fix: pcap-linux.c: create_ring(): calibrate req.tp_frame_size as in tpacket_rcv() (almost). Guy Harris (Mar 23)