Re: [tcpdump-workers] (another) bug in the BPF compiler (wireless)

2007-11-26 Thread Arien Vijn
Hi, On 26 Nov 2007, at 19:05, Gianluca Varenni wrote: I don't know what the status of the libpcap 1.0/tcpdump 4.0 release is, but I'd like to hold on the release for a day or so. I've just found (another) bug in the BPF compiler for wireless link types. A simple filter like "link src host

[tcpdump-workers] patch: Allow various ethernet address notations

2008-01-07 Thread Arien Vijn
Greetings, Attached is a small patch which makes libpcap filter expressions a bit more tolerant towards ethernet (MAC) address notations. When troubleshooting network problems, me and my colleagues often want to cut-and-paste MAC addresses as displayed by network equipment. However, moder

Re: [tcpdump-workers] patch: Allow various ethernet address notations

2008-01-07 Thread Arien Vijn
On 7 Jan 2008, at 16:37, Joerg Mayer wrote: On Mon, Jan 07, 2008 at 03:13:32PM +0100, Arien Vijn wrote: Attached is a small patch which makes libpcap filter expressions a bit more tolerant towards ethernet (MAC) address notations. Did you use invisible ink^H^H^Hpixels in the attached

Re: [tcpdump-workers] tcpdump and wireshark

2008-09-15 Thread Arien Vijn
On 15 sep 2008, at 23:05, Dmitry wrote: Hello. I'm interesting in info extraction from pcap dumps. Recently I did some test dump of downloaded picture with tcpdump and wrote it to file 'dump.pcap'. Test zero: I have started capture on 192.168.0.1 host and did http request of image to 192

Re: [tcpdump-workers] the capture layer about tcpdump,more info

2009-01-17 Thread Arien Vijn
Hello, Just a suggestion. It might be that the NIC you use to capture processes the pause frame and does not put it through to the bus. You might want to try to switch flow control off on the NIC and see what happens then. This under the assumption that the pause frames actually hit your

Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-20 Thread Arien Vijn
On 20 Feb. 2009, at 10:29 AM, Torsten Krah wrote: Am Freitag, 20. Februar 2009 02:35:04 schrieb Michael Richardson: First, are you capturing the entire packet? Hm what do you mean with "entire" packet? How do i know this? The command i have used i told - have i have to do something more to

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-09 Thread Arien Vijn
On 5 Mar. 2009, at 10:20 AM, Guy Harris wrote: Would it make sense to have tcpdump default to the maximum snapshot length, rather than 68 (without IPv6 support) or 96 (with IPv6 support)? I've checked in a change to make the default snapshot length 65535. Suddenly* changing this default

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-09 Thread Arien Vijn
On 10 Mar. 2009, at 2:01 AM, Eloy Paris wrote: On Mon, Mar 09, 2009 at 11:52:50PM +0100, Arien Vijn wrote: Therefore it would be a good idea to make this an option during compile time. Hmmm. Wouldn't this be a bit overkill? And even if we went down this path, I don't

Re: [tcpdump-workers] deduct local IPs from pcap-files, possible?

2010-05-20 Thread Arien Vijn
Hi Andrej, On 20 May 2010, at 04:05, Andrej van der Zee wrote: > Hi, > > Sorry for asking again, but I got no useful answer last time. Hopefully more > luck this time... > > I receive many pcap-files from our clients. Now I am constructing an > algorithm using libpcap that deducts time differe

Re: [tcpdump-workers] ipv6 DAD packets?

2011-03-03 Thread Arien Vijn
On 3 Mar 2011, at 9:52 PM, Jeff Sadowski wrote: > On Thu, Mar 3, 2011 at 1:31 PM, Eloy Paris wrote: >> On 03/03/2011 02:48 PM, Jeff Sadowski wrote: >> >> [...] >> >>> I tried "tcpdump ip6 and icmp" but it says im blocking all. How would >>> I do what I am trying to do? >>> I can't quite figure

Re: [tcpdump-workers] One of these things is not like the others

2017-05-26 Thread Arien Vijn
> On May 24, 2017(21), at 21:23, Michael Richardson wrote: > > Guy Harris wrote: >>> Guy Harris wrote: >>> Note that macOS's tcpdump has a -g flag ("g" for "greppable", more greppable output being the purpose of the flag), which puts the IPv4 input back on one line: >>> >>> Ho