Re: [tcpdump-workers] HUGE packet-drop

2011-02-06 Thread Guy Harris
On Feb 6, 2011, at 10:07 PM, Luca Bruno wrote: > I can't speak for Lenny, but it looks like Squeeze (which was released > a couple of days ago) has both: > * http://packages.debian.org/squeeze/libpcap0.8 Ah, so Squeeze has the libpcap 1.1.1 version of libpcap 0.8. :-) (Yes, it makes no sense to

Re: [tcpdump-workers] A puzzled maintainer with questions regarding

2011-02-06 Thread M.Baris Demiray
Hello, On Mon, Feb 7, 2011 at 12:21 AM, Guy Harris wrote: > > On Feb 4, 2011, at 12:25 AM, M.Baris Demiray wrote: > >> In fact this is not what STANAG 5066 Annex H "Implementation Guide and >> Notes" section suggests. According to this section and the tests held >> by DRA (Defence Research Agency

Re: [tcpdump-workers] HUGE packet-drop

2011-02-06 Thread Luca Bruno
Guy Harris scrisse: > You need at least libpcap 1.0.0 to have tpacket ("turbo-packet", > right?) support in the standard libpcap. You could also get it with > the Phil Wood patches he mentioned, although that only supports > memory-mapped access on Linux, not FreeBSD - but he's using Linux, so >

[tcpdump-workers] allow cooked mode on linux ethernet devices

2011-02-06 Thread Robert Edmonds
hi, i'd like to be able to capture from an ethernet device on linux using the DLT_LINUX_SLL link type. i don't see any way to accomplish this using the existing API; libpcap really wants to give me a DLT_EN10MB handle. i submitted a patch to allow DLT_LINUX_SLL on ethernet devices a few months b

Re: [tcpdump-workers] Best OS / Distribution for gigabit capture?

2011-02-06 Thread Guy Harris
On Feb 5, 2011, at 11:20 PM, M. V. wrote: > as i mentioned in my previous mail, (with the title: "HUGE packet-drop") i'm > having problem trying to dump gigabit traffic on harddisk with tcpdump on > Debian5.0. i tried almost everything but got no success. Did you try to check whether the memor

Re: [tcpdump-workers] HUGE packet-drop

2011-02-06 Thread Guy Harris
On Jan 31, 2011, at 10:56 AM, Jesper Dangaard Brouer wrote: > M. V. yahoo.com> writes: > >> so, i dont know what else to do, seems like nothing works for me :-S >> 1) does anyone have any other suggestions that may help? >> 2) about MMAP support in Debian kernel: i installed Debian5.0.3 from >

Re: [tcpdump-workers] The network is cut with tcpdump.

2011-02-06 Thread Guy Harris
On Feb 3, 2011, at 10:36 AM, Masahiro Kamikubo wrote: > When the tcpdump command was executed hereafter, the network was cut. "Cut" meaning that you lost network connection on the network interface on which you were capturing network traffic? If so, that might be a problem with... > The envir

Re: [tcpdump-workers] A puzzled maintainer with questions regarding

2011-02-06 Thread Guy Harris
On Feb 4, 2011, at 12:25 AM, M.Baris Demiray wrote: > In fact this is not what STANAG 5066 Annex H "Implementation Guide and > Notes" section suggests. According to this section and the tests held > by DRA (Defence Research Agency), > > 1) The throughput is not strongly sensitive to frame size >

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-02-06 Thread Guy Harris
On Feb 4, 2011, at 1:59 AM, Schemmel, Hans-Christoph wrote: > The parts that don“t correspond to a PPP packet are AT commands or responses > (like "ATI", "AT+CSQ" or "+CSQ: 18,99"). This content is interpreted and > displayed as raw text in the Wireshark subtree for the payload/information of >