On Apr 7, 2006, at 10:08 AM, Rick Jones wrote:
As for checking against the normal MTU, does tcpdump/libpcap have
that information?
Only to the extent that it could infer that from the link-layer
type. (Jumbo frames might make that tricky.)
Does libpcap/tcpdump have any way of knowing th
[ I really can't seem to set the proper account for these
responses Here's to fooling the duplicate message detector ]
On 4/4/06, Guy Harris <[EMAIL PROTECTED]> wrote:
> Harley Stenzel wrote:
> > 2) It's not clear under what circumstances a rc 0 could ever be
> > returned. Only on retrun from
ronnie sahlberg wrote:
large segment offload (LSO)
can be easily detected by
TCP checksum==0and being incorrect
and that the segment is much larger than the normal mtu.
I like the idea of there being a few additional sanity checks, like I
said, what I did there was a WAG :) So, adding a
Hannes Gredler wrote:
you may want to check the text2pcap utility
that comes along with ethereal for learning about
conversion to a libpcap readable format.
Or, alternatively, with newer versions of libpcap (those with
pcap_open_dead(), so you can write to a libpcap file without having a
lib
large segment offload (LSO)
can be easily detected by
TCP checksum==0and being incorrect
and that the segment is much larger than the normal mtu.
On 4/7/06, Guy Harris <[EMAIL PROTECTED]> wrote:
> Hannes Gredler wrote:
> > checked in - thanks for the submission - /hannes
> >
> > On Wed, Ja
Hannes Gredler wrote:
checked in - thanks for the submission - /hannes
On Wed, Jan 19, 2005 at 05:35:13PM -0800, Rick Jones wrote:
| A while back I think I posted something asking about what to do about TSO
| (large send) and how it generated "IP bad-len 0" output when tracing on a
| TSO-enab
latha,
you may want to check the text2pcap utility
that comes along with ethereal for learning about
conversion to a libpcap readable format.
/hannes
Latha G wrote:
Hi all,
Is there any way to construct manually a tcpdump readable packet?
As we know the header structres, we can fill those hea
