Re: [tcpdump-workers] 'bogus savefile header'

2010-08-24 Thread Michael Richardson
> "Aaron" == Aaron Turner writes: Aaron> Grrr, it's "git pull" not "git fetch". libpcap tree was out Aaron> of date and that seems to be the cause of the problem. Aaron> Thanks for the help, sorry about the crappy bug report Yes. git pull == git fetch then git merge -- ]

Re: [tcpdump-workers] 'bogus savefile header'

2010-08-24 Thread Aaron Turner
Grrr, it's "git pull" not "git fetch". libpcap tree was out of date and that seems to be the cause of the problem. Thanks for the help, sorry about the crappy bug report. -- Aaron Turner http://synfin.net/         Twitter: @synfinatic http://tcpreplay.synfin.net/ - Pcap editing and replay tool

Re: [tcpdump-workers] 'bogus savefile header'

2010-08-24 Thread Guy Harris
On Aug 23, 2010, at 8:30 PM, Aaron Turner wrote: > So building the latest tcpdump from git and it won't link against the > latest libpcap from git: > > ld: warning: in /usr/local/lib/libpcap.dylib, file was built for > unsupported file format which is not the architecture being linked > (i386) >

[tcpdump-workers] bpf.tcpdump.org back online

2010-08-24 Thread Michael Richardson
I got a message from nagios that it went down last night. A colleague went to investigate, and found that one of our (CREDIL.org)'s XEN hosts has blown a gasket. The disks were moved to another machine, and bpf.tcpdump.org is alive again. (I guess I should give bpf.tcpdump.org an IPv6 tunnel...)

[tcpdump-workers] [libpcap] tcpdump compiles complex expression to incorrect BPF code

2010-08-24 Thread Vadim Goncharov
Hi! This is a bug in libpcap 0.9.8 (confirmed for 1.0.0) initially reported at http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/144325 I tried to gather statistics on some packets based on signature in data payload, for plain traffic that was simple "tcpdump 'udp[20:4]=0x7fff'" (this works) bu

Re: [tcpdump-workers] pcap_get_selectable_fd q

2010-08-24 Thread Guy Harris
On Aug 24, 2010, at 5:11 AM, Tim mizas wrote: > What kind of FD does pcap_get_selectable_fd return? It returns either 1) the same FD that pcap_fileno() returns, if select() is supported on it or 2) -1, if select() is *not* supported on it (which is the case in, for example,

[tcpdump-workers] pcap_get_selectable_fd q

2010-08-24 Thread Tim mizas
What kind of FD does pcap_get_selectable_fd return? I thought it was a socket's, but when I tried to do a recv on it, I got an error saying the FD wasn't a socket. Thanks, Tim - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.