Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-09 Thread Arien Vijn
On 10 Mar. 2009, at 2:01 AM, Eloy Paris wrote: On Mon, Mar 09, 2009 at 11:52:50PM +0100, Arien Vijn wrote: Therefore it would be a good idea to make this an option during compile time. Hmmm. Wouldn't this be a bit overkill? And even if we went down this path, I don't think that recompil

Re: [tcpdump-workers] pcap_next/pcap_dispatch on VMware vmnet device

2009-03-09 Thread Chris Morgan
On Mon, Mar 9, 2009 at 7:51 PM, Guy Harris wrote: > > On Mar 9, 2009, at 4:10 PM, Chris Morgan wrote: > >> Opening a live capture as root (using sudo), on a vmware bridge device >> on Linux 2.6.27, using a timeout of 1000ms. I'm seeing pcap_next() and >> pcap_dispatch() getting stuck reading, no t

Re: [tcpdump-workers] Should the default snapshot length in

2009-03-09 Thread Eloy Paris
On Mon, Mar 09, 2009 at 11:52:50PM +0100, Arien Vijn wrote: > On 5 Mar. 2009, at 10:20 AM, Guy Harris wrote: > >>> Would it make sense to have tcpdump default to the maximum snapshot >>> length, rather than 68 (without IPv6 support) or 96 (with IPv6 >>> support)? >> >> I've checked in a change

Re: [tcpdump-workers] pcap_next/pcap_dispatch on VMware vmnet device not timing out

2009-03-09 Thread Guy Harris
On Mar 9, 2009, at 4:10 PM, Chris Morgan wrote: Opening a live capture as root (using sudo), on a vmware bridge device on Linux 2.6.27, using a timeout of 1000ms. I'm seeing pcap_next() and pcap_dispatch() getting stuck reading, no timeouts are occurring. Is there a robust and efficient way of

[tcpdump-workers] pcap_next/pcap_dispatch on VMware vmnet device not timing out

2009-03-09 Thread Chris Morgan
Opening a live capture as root (using sudo), on a vmware bridge device on Linux 2.6.27, using a timeout of 1000ms. I'm seeing pcap_next() and pcap_dispatch() getting stuck reading, no timeouts are occurring. Is there a robust and efficient way of reading packets that won't block forever like this?

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-09 Thread Arien Vijn
On 5 Mar. 2009, at 10:20 AM, Guy Harris wrote: Would it make sense to have tcpdump default to the maximum snapshot length, rather than 68 (without IPv6 support) or 96 (with IPv6 support)? I've checked in a change to make the default snapshot length 65535. Suddenly* changing this default

Re: [tcpdump-workers] Unable to successfully compile version 4.0.0

2009-03-09 Thread Randal T. Rioux
On Fri, March 6, 2009 5:03 pm, Scott Hodler wrote: > I am on a Solaris 10 05/08 system using gcc 3.4.6. I have libiconv 1.11 > as required by gcc 3.4.6 on the system and I have compiled the new > libpcap version 1.0.0. I ran the make install for libpcap and added the > needed entries to $PATH and

[tcpdump-workers] Unable to successfully compile version 4.0.0

2009-03-09 Thread Scott Hodler
I am on a Solaris 10 05/08 system using gcc 3.4.6. I have libiconv 1.11 as required by gcc 3.4.6 on the system and I have compiled the new libpcap version 1.0.0. I ran the make install for libpcap and added the needed entries to $PATH and $LD_LIBRARY_PATH, as well as leaving the source code under

Re: [tcpdump-workers] Should "-K" disable IP and UDP checksum verification, in addition to disabling TCP checksum verification?

2009-03-09 Thread Guy Harris
On Feb 20, 2009, at 7:10 PM, Guy Harris wrote: Is there any networking hardware out there that does TCP checksum generation for outgoing packets but doesn't do IP or UDP checksum generation? If not, "-K" might as well imply that IP and UDP checksums aren't valid for outgoing packets, eith

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-09 Thread Guy Harris
On Feb 20, 2009, at 7:08 PM, Guy Harris wrote: The "tcp" in "tcpdump" is a bit old - people use it for doing more than just looking at TCP headers these days - and it sounds as if the problem Torsten Krah had tring to decrypt ipsec traffic was due to the packets being cut short by a snapsh