block 420129 by 481240 severity 420129 important thanks The behaviour you observe is caused by the fact that libnids by default filters packets with incorrect checksum, and that, if checksum calculation is done in hardware, libpcap is only able to capture outgoing packets before the checksum is correctly calculated.
Fixing this problem properly requires changes in libpcap. A workaround is to either turn off filtering packets with incorrect checksum (libnids provides an option to do so, selectively if desired), or to turn off checksum offloading (you can do it with ethtool). (All of this _really_ should be documented, by the way.) Since the problem is caused by issues external to libnids, and since libnids provides a workaround, I am lowering the severity. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
