Re: [tcpdump-workers] pcap files with file header snaplen < packet

2006-12-05 Thread Aaron Turner
On 12/5/06, Jefferson Ogata <[EMAIL PROTECTED]> wrote: Aaron Turner wrote: > Perhaps I'm confused... how does an application using the libpcap API > get access to the snaplen? I don't see any way to do that. int pcap_snapshot (pcap_t *) Ah... there it is. Doh. > Furthermore, all the libpc

Re: [tcpdump-workers] pcap files with file header snaplen < packet

2006-12-05 Thread Jefferson Ogata
Aaron Turner wrote: > Perhaps I'm confused... how does an application using the libpcap API > get access to the snaplen? I don't see any way to do that. int pcap_snapshot (pcap_t *) > Furthermore, all the libpcap functions seem to return a pointer to the > packet buffer, and said buffer is allo

Re: [tcpdump-workers] pcap files with file header snaplen < packet

2006-12-05 Thread Aaron Turner
On 12/5/06, Jefferson Ogata <[EMAIL PROTECTED]> wrote: Aaron Turner wrote: > Storing (or processing) the snaplen seems to open the door for > problems with little benefit (the cost of wasting a few thousand bytes > or incurring the performance penalty of a realloc if the default is to > small).

Re: [tcpdump-workers] pcap files with file header snaplen < packet

2006-12-05 Thread Jefferson Ogata
Aaron Turner wrote: > Storing (or processing) the snaplen seems to open the door for > problems with little benefit (the cost of wasting a few thousand bytes > or incurring the performance penalty of a realloc if the default is to > small). Actually, if you took the snaplen as merely a hint to the

[tcpdump-workers] [PATCH] fix for bluetooth finddevs

2006-12-05 Thread Paolo Abeni
hi list, The attached patch fix a bug in the bt_platform_finddevs function. Currently, when bluetooth protocol is not supported by kernel, bt_platform_finddevs returns an error code. With the attached patch, in such situation, the function simply does not modify the device list and terminates wit

Re: [tcpdump-workers] again usb sniffing: RFC

2006-12-05 Thread Guy Harris
Paolo Abeni wrote: - I'm not able to take advantage of the memory mapped access: the kernel prepend to each event an header that is quite different form the libpcap pcap_usb_header. To keep thinks working I need to modify 'in-place' this header (but this requires write access to the memory mappe

[tcpdump-workers] again usb sniffing: RFC

2006-12-05 Thread Paolo Abeni
Hi list, I finally build-up the code to use the next-to came linux kernel API for USB sniffing. I performed some simple test with a patched wireshark and it seams to work nicely, but: - I'm not able to take advantage of the memory mapped access: the kernel prepend to each event an header that is