Re: [tcpdump-workers] 'bogus savefile header'

2010-08-23 Thread Aaron Turner
So building the latest tcpdump from git and it won't link against the latest libpcap from git: ld: warning: in /usr/local/lib/libpcap.dylib, file was built for unsupported file format which is not the architecture being linked (i386) running file against the actual file (libpcap.dylib is a symlin

Re: [tcpdump-workers] pcap_dispatch on linux 2.6 with libpcap 1.1.1

2010-08-23 Thread Jim Lloyd
On Sun, Aug 22, 2010 at 11:44 PM, Guy Harris wrote: > > On Aug 21, 2010, at 3:30 PM, Jim Lloyd wrote: > > > I have tested with the above logic while sniffing traffic on a GigE > ethernet > > NIC (eth0) and on the loopback device (lo). The test machine is an 8-core > > Opteron with 32Gb of RAM run

Re: [tcpdump-workers] 'bogus savefile header'

2010-08-23 Thread Aaron Turner
On Mon, Aug 23, 2010 at 12:08 PM, Guy Harris wrote: > > On Aug 22, 2010, at 4:15 PM, Aaron Turner wrote: > >> Long story short, tcpreplay allows users to replay traffic in "verbose >> mode" which basically involves forking tcpdump and writing each packet >> over a socketpair().  This has worked fo

[tcpdump-workers] pcap_lookupnet() for IPv6

2010-08-23 Thread yet another braindamaged entity
Hello I wonder if there is a similiar function for IPv6 stack or any other way to get IPv6 netmask. I couldn't find it. Wbr. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] [RFC PATCH 0/2]: hw timestamp support

2010-08-23 Thread Guy Harris
On Aug 23, 2010, at 12:17 PM, Mcmillan, Scott A wrote: > As I was testing your changes, I noticed some very minor build issues, > resolved by this small patch: Thanks. I've checked your fixes into the trunk and 1.1 branches and pushed them. - This is the tcpdump-workers list. Visit https://co

Re: [tcpdump-workers] [RFC PATCH 0/2]: hw timestamp support

2010-08-23 Thread Mcmillan, Scott A
Guy, Thank you for significantly improving and merging this capability into the official repository. I fully agree with your changes. I was thinking that way myself, but was hesitant to propose changes of that degree as my first contribution. As I was testing your changes, I noticed some ver

Re: [tcpdump-workers] 'bogus savefile header'

2010-08-23 Thread Guy Harris
On Aug 22, 2010, at 4:15 PM, Aaron Turner wrote: > Long story short, tcpreplay allows users to replay traffic in "verbose > mode" which basically involves forking tcpdump and writing each packet > over a socketpair(). This has worked for quite a while (years now) > but recently I've realized som

[tcpdump-workers] 'bogus savefile header'

2010-08-23 Thread Aaron Turner
Long story short, tcpreplay allows users to replay traffic in "verbose mode" which basically involves forking tcpdump and writing each packet over a socketpair(). This has worked for quite a while (years now) but recently I've realized something broke along the way and I'm at a loss to as why. Ba

Re: [tcpdump-workers] BPF syntax extension for GTP-U (mobile ip packet)

2010-08-23 Thread Guy Harris
On Aug 22, 2010, at 10:15 PM, Ambika Prasad Tripathy wrote: > But my proposal is to include a filter like VLAN for GTP. Exactly. See my response to your earlier message, except that: > So after support it the above filter will work like > > "Gtp 23456345" to filter all GTP packets with TEID

Re: [tcpdump-workers] BPF syntax extension for GTP-U (mobile ip packet)

2010-08-23 Thread Guy Harris
On Aug 17, 2010, at 2:21 AM, Ambika Prasad Tripathy wrote: > I am searching a way how to filter GTP packets and hence mobile IP data over > GTP-U. I can do that by applying index based filter for BPF. But can when I > see struct bpf_insn structure I think, if I modify the gencode.c/h and > gramme