Re: [tcpdump-workers] Libpcap timeout settings in tcpdump - too long when printing to a terminal?

2015-01-09 Thread Michal Sekletar
On Thu, Jan 08, 2015 at 06:57:08PM -0800, Guy Harris wrote: > With TPACKET_V3 support, Linux users are discovering what those of us using > BSD-flavored OSes have known for quite a while: > > > http://askubuntu.com/questions/570885/can-tcpdump-on-ubuntu-14-04-show-packets-in-real-time > >

Re: [tcpdump-workers] [libpcap] New DLT value Request - Wattstopper DLM (#401)

2015-01-09 Thread Steve Karg
Hello Guy, >> The Family/Address/IR field contains 3-bits of family code, 2-bits of >> address mode, 2-bits of IR (infrared) routing, and 1-bit unused. >> The 8 Legrand NITOO families are 000=CAD Filaire, 001=TopDog, 010=CAD RF, >> 011=CAD PLC, 100=CAD IR, 101=DLM, 111=escape, and 111=DLM Bootload

Re: [tcpdump-workers] Libpcap timeout settings in tcpdump - too long when printing to a terminal?

2015-01-09 Thread Michael Richardson
Guy Harris wrote: > The longer timeout can reduce capturing overhead, and if you're > capturing a high volume of traffic to a file, it's probably the right > timeout to have. If, however, you're printing packets to the console, > you're probably doomed if it's a high volume of tr

Re: [tcpdump-workers] Libpcap timeout settings in tcpdump - too long when printing to a terminal?

2015-01-09 Thread Guy Harris
On Jan 9, 2015, at 2:09 AM, Michal Sekletar wrote: > Can't we use new default timeout value (lower) if we detect TPACKET_V3, The first sentence of my original mail was "With TPACKET_V3 support, Linux users are discovering what those of us using BSD-flavored OSes have known for quite a while:"

Re: [tcpdump-workers] [libpcap] New DLT value Request - Wattstopper DLM (#401)

2015-01-09 Thread Guy Harris
On Jan 9, 2015, at 8:08 AM, Steve Karg wrote: > Hello Guy, > >>> The Family/Address/IR field contains 3-bits of family code, 2-bits of >>> address mode, 2-bits of IR (infrared) routing, and 1-bit unused. >>> The 8 Legrand NITOO families are 000=CAD Filaire, 001=TopDog, 010=CAD RF, >>> 011=CAD P

Re: [tcpdump-workers] [libpcap] New DLT value Request - Wattstopper DLM (#401)

2015-01-09 Thread Steve Karg
Hello Guy, The Family/Address/IR field contains 3-bits of family code, 2-bits of address mode, 2-bits of IR (infrared) routing, and 1-bit unused. The 8 Legrand NITOO families are 000=CAD Filaire, 001=TopDog, 010=CAD RF, 011=CAD PLC, 100=CAD IR, 101=DLM, 111=escape, and 111=DLM

Re: [tcpdump-workers] [libpcap] New DLT value Request - Wattstopper DLM (#401)

2015-01-09 Thread Guy Harris
On Jan 9, 2015, at 4:11 PM, Steve Karg wrote: >> I.e., following the Family/Address/IR field, other families might not have >> the Sequence ID, Source and Destination MAC addresses, Opcode, and Payload >> Length followed by Payload? > > Yes, that is correct. OK, so we should, for now, indica

Re: [tcpdump-workers] [libpcap] New DLT value Request - Wattstopper DLM (#401)

2015-01-09 Thread Steve Karg
Hello Guy, > 6 or 7 - escape > 7 or 6 - DLM Bootloader > > The information you quoted said "111=escape, and 111=DLM Bootloader"; I > assume one of those 111's is supposed to be 110. Which one of them should be > 110? 6 - unused 7 - escape and DLM Bootloader (unfortunately). Th