Re: [tcpdump-workers] libpcap1.1.1 truncates UDP payload, ring buffer problem?

2011-06-02 Thread Guy Harris
On Jun 1, 2011, at 5:58 AM, mold2010 wrote: > I tried libpcap1.1.1 release libpcap_1_1rel0 from > https://github.com/mcr/libpcap. But found the same issue. Where can I get the > 1.2 branch? Is it git hub: libpcap? Both the 1.2 branch and the trunk can be found on bpf.tcpdump.org, and probably

Re: [tcpdump-workers] [PATCH] ifSpeed in sFlow is 64 bits not 32

2011-06-02 Thread Guy Harris
On May 27, 2011, at 5:59 PM, Rick Jones wrote: > The ifSpeed field of a generic interface counter in sFlow is 64 bits. > The "overlay" definition in print-sflow.c is correct, but the actual > extract for printing is using EXTRACT_32BITS rather than EXTRACT_64BITS, > which leads to an incorrect re

Re: [tcpdump-workers] [PATCH] ifSpeed in sFlow is 64 bits not 32

2011-06-02 Thread Rick Jones
On Thu, 2011-06-02 at 10:57 -0700, Guy Harris wrote: > On May 27, 2011, at 5:59 PM, Rick Jones wrote: > > > The ifSpeed field of a generic interface counter in sFlow is 64 bits. > > The "overlay" definition in print-sflow.c is correct, but the actual > > extract for printing is using EXTRACT_32BIT

Re: [tcpdump-workers] [PATCH] ifSpeed in sFlow is 64 bits not 32

2011-06-02 Thread Guy Harris
On Jun 2, 2011, at 11:10 AM, Rick Jones wrote: > Oops - I keep forgetting that all my compiles are 64 bit and so don't > remember to check for such things. You need an OS and build tools that make it easier to build stuff both ways (and on which recent versions of libpcap and tcpdump default to

Re: [tcpdump-workers] [libpcap][patch] appending to a capture

2011-06-02 Thread Aaron Turner
On Wed, Jun 1, 2011 at 9:24 AM, Gerald Combs wrote: > On 6/1/11 8:10 AM, Mark Johnston wrote: >> Hi Darren, >> >> On Tue, May 31, 2011 at 03:53:22PM -0700, Darren Reed wrote: >> >>> You might be better off spending some time working >>> on additions to editcap that include concatenating >>> two or