Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-01-12 Thread Guy Harris
On Jan 12, 2011, at 4:59 AM, Schemmel, Hans-Christoph wrote: > A packet begins with a flag (octet 0xF9, section 5.2.1.1), followed by address > and control field. Is this DLT value only for the Basic Option, or is it also used for the Advanced Option? If it's also for the Advanced Option:

Re: [tcpdump-workers] Linux system headers 2.6.36 and pcap/bpf.h

2011-01-12 Thread Guy Harris
On Jan 11, 2011, at 11:47 PM, Tim Sammut wrote: > Is this a known issue, It was not known to me until now. > or is there a more correct workaround? None that I know of. I'm looking at a change that should fix this without breaking any reasonable code, although I'm sure somebody will have fig

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-01-12 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > > On Jan 10, 2011, at 6:16 AM, Schemmel, Hans-Christoph wrote: > > > I´ve written a dissector (MUX27010) for wireshark and I want to commit it to the project. Therefore I need > a new DLT value for this dissector/protocol because the protocol doesn´t base u

[tcpdump-workers] Sequence Numbers

2011-01-12 Thread Nfl Expert
Good morning, Do newer version of tcpdump no longer show TCP sequence numbers without the -vv flag? Or is this some kind of FreeBSD bug? FreeBSD 7.2 (tcpdump 3.9.7): 07:06:47.765297 IP x.x.x.x.58894 > 209.87.252.181.443: P 285:344(59) ack 1589 win 16695 07:06:47.827029 IP 209.87.252.181.443 >

[tcpdump-workers] Linux system headers 2.6.36 and pcap/bpf.h

2011-01-12 Thread Tim Sammut
Hello. I have an odd problem and I am hoping you all can help. It appears that starting in the Linux system headers around version 2.6.36 [1], /usr/include/linux/if_tun.h began including /usr/include/linux/filter.h [2]. filter.h however, defines BPF_MAJOR_VERSION which ends up excluding the entir