Re: [tcpdump-workers] [Patch] Host Identity Protocol

2009-07-16 Thread Samu Varjonen
Hi, Sorry for delayd answer. I will look into your suggestions/commnents and revise the patch accordingly as soon as possible and I'll resend the patch to the list. Guy Harris kirjoitti: On Jul 10, 2009, at 2:16 AM, Varjonen Samu wrote: diff -N -r -u --strip-trailing-cr tcpdump-orig/config

[tcpdump-workers] "stream" data from tcpdump

2009-07-16 Thread Gilgamesh Enkidu
I would like to "stream" data from tcpdump to another application. I'm running tcpdump on an interface and doing some pretty tight filtering on it. Occasionally, I would like to run another tool (eg. snort, tshark) on the filtered stream of data. It seems less than ideal to have to run the other

Re: [tcpdump-workers] -i man "Ties are broken by choosing the earliest match."

2009-07-16 Thread Guy Harris
On Jul 16, 2009, at 12:49 PM, Doru Georgescu wrote: Indeed, I was not logged in. I don't know how to apologize. By telling the SourceForge people that their error message is very unhelpful. :-) I.e., given how horribly wrong their error message is, I don't think you have anything for wh

Re: [tcpdump-workers] -i man "Ties are broken by choosing the earliest match."

2009-07-16 Thread Doru Georgescu
> SourceForge said comments were closed when they really meant "you have > to be logged in to make comments"? That's *REALLY* stupid, but error > reporting always seems to be one of the worst parts of software - > people want to work on the parts of the code where things work, and > handli

Re: [tcpdump-workers] -i man "Ties are broken by choosing the earliest match."

2009-07-16 Thread Doru Georgescu
> No - that section of the manual refers to selecting an interface, not > to matching packets when filtering. > > As far as I can tell, "ties are broken by choosing the earliest match" > means "for some reason, we didn't just say that the first interface in > the list is used". > Thanks. I

Re: [tcpdump-workers] -i man "Ties are broken by choosing the earliest match."

2009-07-16 Thread Guy Harris
On Jul 16, 2009, at 12:10 PM, Doru Georgescu wrote: Yes, the comments have been definitely disabled, for me. This is what I see there (http://sourceforge.net/tracker/?func=detail&aid=2813234&group_id=53066&atid=469573 ), on a wonderful yellow background: Comments have been closed for this a

Re: [tcpdump-workers] Libpcap

2009-07-16 Thread Guy Harris
On Jul 16, 2009, at 3:13 AM, Chris Davies wrote: I have a program that uses libpcap to snoop on packets for the purposes of monitoring. It works very well when compiled on a 32 bit Linux machine and run on a 32 bit Linux and when 64 bit Linux machine and run on a 64 bit Linux. However it

[tcpdump-workers] -i man "Ties are broken by choosing the earliest match."

2009-07-16 Thread Doru Georgescu
Yes, the comments have been definitely disabled, for me. This is what I see there (http://sourceforge.net/tracker/?func=detail&aid=2813234&group_id=53066&atid=469573), on a wonderful yellow background: Comments have been closed for this artifact. Also, the list subscription instructions on h

Re: [tcpdump-workers] Libpcap

2009-07-16 Thread Gianluca Varenni
What do you mean by "it doesn't work correctly"? 1. compilation problems? 2. linking problems? 3. the application runs but fails to list the adapters? 4. the application runs, you can open the adapter but you dont capture any packet? 5. the application runs and captures but it eventually crash

Re: [tcpdump-workers] Libpcap

2009-07-16 Thread Tyler Littlefield
if pcap uses the 32-bit libraries, you'll need glibc 32 bit, etc. - Original Message - From: "Chris Davies" To: Sent: Thursday, July 16, 2009 4:13 AM Subject: [tcpdump-workers] Libpcap Trying to get libpacp to work in 32 bit mode on 64 bit machines. I have a program that uses li

Re: [tcpdump-workers] -i man "Ties are broken by choosing the earliest match."

2009-07-16 Thread Guy Harris
On Jul 16, 2009, at 9:04 AM, Doru Georgescu wrote: Please explain what this means, -i in manual: "Ties are broken by choosing the earliest match." Ties between what and what? Match, I suppose, is between the tcpdump expression and packets headers. No - that section of the manual refers to sel

[tcpdump-workers] Libpcap

2009-07-16 Thread Chris Davies
Trying to get libpacp to work in 32 bit mode on 64 bit machines. I have a program that uses libpcap to snoop on packets for the purposes of monitoring. It works very well when compiled on a 32 bit Linux machine and run on a 32 bit Linux and when 64 bit Linux machine and run on a 64 bit Linux.

[tcpdump-workers] -i man "Ties are broken by choosing the earliest match."

2009-07-16 Thread Doru Georgescu
Please explain what this means, -i in manual: "Ties are broken by choosing the earliest match." Ties between what and what? Match, I suppose, is between the tcpdump expression and packets headers. I answer here to guy_harris on http://sourceforge.net/tracker/?func=detail&aid=2813234&group_id=5306

Re: [tcpdump-workers] Request new DLT value for raw fibre channel

2009-07-16 Thread Guy Harris
On Jul 15, 2009, at 6:41 PM, kahou lei wrote: Just curious, if the FC packet has 4 bytes SOF in front of R_CTL, can I use the same value? No; DLT values must unambiguously specify the link-layer encapsulation, so a different DLT value should be used. - This is the tcpdump-workers list. V