Re: [tcpdump-workers] Writing pcap files with fake headers?

2010-04-06 Thread Guy Harris
On Apr 6, 2010, at 7:54 PM, ronnie sahlberg wrote: > Pcap does not have a raw-udp encapsulation, so yours is a reasonable approach. It does, however, have a raw-IP encapsulation; the link-layer type value in the file header would be 101, and the raw packet data begins with the IP header. A li

Re: [tcpdump-workers] Writing pcap files with fake headers?

2010-04-06 Thread Eloy Paris
Hi Roy, On Tue, Apr 06, 2010 at 09:56:37PM -0400, Roy Smith wrote: > I've got an application which listens for UDP (SNMP) data. We want > to add a logging feature where every UDP packet that's received is > stored for future analysis. The obvious file format is pcap. It's > simple and lets us

Re: [tcpdump-workers] Writing pcap files with fake headers?

2010-04-06 Thread Aaron Turner
On Tue, Apr 6, 2010 at 6:56 PM, Roy Smith wrote: > I've got an application which listens for UDP (SNMP) data.  We want to add a > logging feature where every UDP packet that's received is stored for future > analysis.  The obvious file format is pcap.  It's simple and lets us take > advantage of l

Re: [tcpdump-workers] Writing pcap files with fake headers?

2010-04-06 Thread ronnie sahlberg
Pcap does not have a raw-udp encapsulation, so yours is a reasonable approach. Ethernet addresses as all 0, type 0x0800, skip the crc completely. This is what the fake ethernet header looks like when you capture on loopback on linux. Fake IP header. UDP header checksum to 0x. (Wireshark tr

[tcpdump-workers] Writing pcap files with fake headers?

2010-04-06 Thread Roy Smith
I've got an application which listens for UDP (SNMP) data. We want to add a logging feature where every UDP packet that's received is stored for future analysis. The obvious file format is pcap. It's simple and lets us take advantage of lots of existing pcap-aware tools. The problem is

Re: [tcpdump-workers] make check problems

2010-04-06 Thread Michael Richardson
> "Ondrej" == Ondrej Mori writes: Ondrej> Hi, You did see this: uudecode --help || (echo "No uudecode program found, not running tests"; echo "apt-get/rpm install sharutils?"; exit 1) Usage: uudecode [FILE]... Mandatory arguments to long options are mandatory to short options too. -o

Re: [tcpdump-workers] make check problems

2010-04-06 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > "Ondrej" == Ondrej Mori writes: Ondrej> Hi, Ondrej> there are some failures in make check (output attached), is Ondrej> it some known bug? Actually there is a bug in both lmp.sh Ondrej> and print-flags.sh - these scripts exit w

[tcpdump-workers] make check problems

2010-04-06 Thread Ondrej Moriš
Hi, there are some failures in make check (output attached), is it some known bug? Actually there is a bug in both lmp.sh and print-flags.sh - these scripts exit with 0 no matter what diff command returns and therefore these tests (in TESTrun.sh) always report 'pass'. May I ask you what is c

[tcpdump-workers] make check problems

2010-04-06 Thread Ondrej Moriš
Hi, there are some failures in make check (output attached), is it some known bug? Actually there is a bug in both lmp.sh and print-flags.sh - these scripts exit with 0 no matter what diff command returns and therefore these tests (in TESTrun.sh) always report 'pass'. May I ask you what is c

Re: [tcpdump-workers] 4.1.1/1.1.1

2010-04-06 Thread Luis MartinGarcia.
On 04/06/2010 04:40 AM, Michael Richardson wrote: > > I noticed that the links in the main page all say: > > http://www.tcpdump.org/tcpdump_man.html";>Tcpdump man > page > > I.e. they are absolute. I can't think of a good reason for this. > Why shouldn't they be relative? > > I logged in