Re: [tcpdump-workers] setfilter causes core on Solaris

2007-12-05 Thread Andy Howell
Guy Harris wrote: The same problem exists in some other pcap-XXX.c files. I fixed it by getting rid of the fcode variable, and just passing the fcode.bf_insns member of the structure. Guy, Thanks. Sorry I didn't look at the others. Regards, Andy - This is the tcp

Re: [tcpdump-workers] setfilter causes core on Solaris

2007-12-05 Thread Guy Harris
On Dec 5, 2007, at 5:18 AM, Andy Howell wrote: I'm using pcap_dispatch to call my callback. Inside the callback, I may set a new filter. This results in a core dump in bpf_filter.c, line 239. Its calling abort because of a bad filter code. This will only happen with a live capture. The b

Re: [tcpdump-workers] [PATCH] enable memory mapped access to ethernet devices

2007-12-05 Thread Abeni Paolo
hello, Gregor Maier wrote: > Using a function to set the ring buffer size sounds like the best choice > to me, as long as these parameters can still be changed after the open > or after packets have been read. In the easier implementation I can think of, changing the ring size will cause the lo

Re: [tcpdump-workers] [PATCH] enable memory mapped access toethernet

2007-12-05 Thread Gianluca Varenni
I agree with you. Consider that under windows, for example, we have a windows-only function to set the kernel buffer size (http://www.winpcap.org/docs/docs_40_2/html/group__wpcapfunc.html#g124bde25ccd9e39017ff2abec2dda623) and the kernel buffer in WinPcap is actually a ring buffer (although we

Re: [tcpdump-workers] [PATCH] enable memory mapped access toethernet

2007-12-05 Thread Gregor Maier
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > > The idea behind the snaplen [miss-]use is to permit legacy application > to take advantage of the memory mapped access and permit new ones to > control the ring behaviur. Such goal could be obtained even with other > solution, but I was a bit 'sc

Re: [tcpdump-workers] [PATCH] enable memory mapped access toethernet device for linux

2007-12-05 Thread Paolo Abeni
hello, On Wed, 2007-12-05 at 08:23 -0800, Gianluca Varenni wrote: > From what you said, you basically changed the behavior of the snaplen > parameter of pcap_open_live(). At the risk of being annoing, I find it a > really bad idea. If it's called snaplen, it's the snaplen, period. > Isn't it pos

Re: [tcpdump-workers] [PATCH] enable memory mapped access to ethernet device for linux

2007-12-05 Thread Gianluca Varenni
From what you said, you basically changed the behavior of the snaplen parameter of pcap_open_live(). At the risk of being annoing, I find it a really bad idea. If it's called snaplen, it's the snaplen, period. Isn't it possible to add a pcap function to set such parameter (or eventually create a

[tcpdump-workers] setfilter causes core on Solaris

2007-12-05 Thread Andy Howell
I'm using pcap_dispatch to call my callback. Inside the callback, I may set a new filter. This results in a core dump in bpf_filter.c, line 239. Its calling abort because of a bad filter code. This will only happen with a live capture. The bug is actually in pcap-dlpi.c. It keeps a pointer to

[tcpdump-workers] [PATCH] enable memory mapped access to ethernet device for linux

2007-12-05 Thread Paolo Abeni
hi list, Following the discussion about the memory mapped access for Linux, I tried to rework some existing code (originally independently created by Simon Patarin and Phil Wood) to enable this functionality with the minimum impact on the current pcap code. It does not use environment variables

[tcpdump-workers] [PATCH] fix some typo in pcap-usb-linux

2007-12-05 Thread Paolo Abeni
hello, the attached trivial patch fix a couple of typos in the comments of pcap-usb-linux.c. I fear that others grammar/spell errors are present in the code I submitted due to my poor English. I'll try to look after for them... ciao, paolo --