[tcpdump-workers] :

2005-08-07 Thread Francisco.mesquita
Try this.

Re: [tcpdump-workers] Strange PCAP filter compilation with certain

2005-08-07 Thread Guy Harris
Guy Harris wrote: There should probably be another way of indicating "we're now parsing MPLS-encapsulated stuff", e.g. a Boolean flag. I'll look at implementing that (and put it into the x.9 branch). I've checked into the main and x.9 branches a change to do that (with a Boolean flag). Co

Re: [tcpdump-workers] Strange PCAP filter compilation with certain

2005-08-07 Thread Guy Harris
Jan C. Nordholz wrote: init_linktype() sets off_linktype to -1 (not present), and off_nl (and _nosnap) to 0 (packet starts immediately), which is fine. But gen_proto() insists that for Q_IP, regardless of the current DLT, the link level should be inspected: ...which is also fine; "gen_linktype

[tcpdump-workers] Strange PCAP filter compilation with certain DLTs

2005-08-07 Thread Jan C. Nordholz
Dear list members, while working for a university project, I stumbled across the following problem: Part A of our program grabs a packet from a network device, strips off the link level header, and forwards the packet to part B. B then wants to match the packet with the pcap filter mechanism, and

Re: [tcpdump-workers] Filter on offline pcap

2005-08-07 Thread cycl0ne dude
is there a better way of filtering captured file size? i know checking the filesize of the save_file for every pcap_dump() is not a good idea, so im thinking if theres a winpcap function that i can use to monitor the file size of the save_file? thanks again for your help! cycl0ne On 8/5/05, cycl