Re: [tcpdump-workers] Convert Wireshark Filterstring to winpcap filter

2009-10-09 Thread Guy Harris
On Oct 8, 2009, at 3:59 AM, wrote: 1.) I'd urgently need help/advice of how the following filter string has to be to be set as winpcap filter-string: I can't find any working string for the protocols. "eth src 00:0e:0C:76:86:5e" is working. Thanks for any reply and help My filter in

Re: [tcpdump-workers] pcap-bpf and AIX odm related code

2009-10-09 Thread Guy Harris
On Oct 9, 2009, at 7:11 AM, Michael Richardson wrote: I do not know if there are any AIX users left. For me, it's been at least 15 years since I had one with a compiler. (Not counting the VIO LPAR server on IBM pSeries...) I wonder if we can even maintain this branch of pcap at this point? W

Re: [tcpdump-workers] pcap-bpf and AIX odm related code

2009-10-09 Thread Guy Harris
On Oct 8, 2009, at 12:30 PM, Jean-Louis CHARTON wrote: Am I right? Almost certainly - I'm not an AIX expert, but I don't see any reason why you *wouldn't* be right. I've checked in and pushed your changes on the main Git branch. - This is the tcpdump-workers list. Visit https://cod.sandel

Re: [tcpdump-workers] pcap-bpf and AIX odm related code

2009-10-09 Thread Guy Harris
On Oct 9, 2009, at 3:22 AM, Jean-Louis CHARTON wrote: BTW, does someone know why the number of BPF devices is limited to 4 (at least on AIX)? Because the people at IBM who maintain AIX's BPF and tcpdump/libpcap don't have a clue? That's certainly the impression I get, from 1) the fact

Re: [tcpdump-workers] Anyone has seen this error "can't create rx ring on packet socket 10: 92-Protocol not available"?

2009-10-09 Thread Guy Harris
On Oct 9, 2009, at 1:53 PM, Tillmann Werner wrote: No, but it sounds like you are using Linux and your kernel's raw socket interface does not support PF_PACKET. Nope. That message comes if a setsockopt(fd, SOL_PACKET, PACKET_RX_RING, ...) fails on a PF_PACKET socket FD - if the kernel

Re: [tcpdump-workers] Anyone has seen this error "can't create rx

2009-10-09 Thread Tillmann Werner
No, but it sounds like you are using Linux and your kernel's raw socket interface does not support PF_PACKET. Maybe that helps. Tillmann - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] pcap-bpf and AIX odm related code

2009-10-09 Thread Michael Richardson
I do not know if there are any AIX users left. For me, it's been at least 15 years since I had one with a compiler. (Not counting the VIO LPAR server on IBM pSeries...) I wonder if we can even maintain this branch of pcap at this point? -- ] He who is tired of Weird Al is tired of life!

Re: [tcpdump-workers] pcap-bpf and AIX odm related code

2009-10-09 Thread Jean-Louis Charton
BTW, does someone know why the number of BPF devices is limited to 4 (at least on AIX)? Is there a technical reason for this ? I've tried to add one more bpf device (/dev/bpf4) on an AIX 5.1 box. The device configuration seems ok (i.e. the sysconfig() calls are successfull). I can launch up to 4

Re: [tcpdump-workers] [PATCH] SocketCAN support for libpcap - draft implementation

2009-10-09 Thread Alexander Dupuy
Felix Obenhuber wrote: 2. The can frame struct is defined like this (from linux/can.h): /** * struct can_frame - basic CAN frame structure * @can_id: the CAN ID of the frame and CAN_*_FLAG flags, see above. * @can_dlc: the data length field of the CAN frame * @data:the CAN frame payload.