Re: [tcpdump-workers] pcap_findalldevs, pcap_addr doesn't have AF_INET entries on OSX

2011-04-03 Thread Guy Harris
On Apr 3, 2011, at 4:24 PM, Bob wrote: > Yes, I'm checking the whole linked list. I get an AF_LINK and AF_INET6 per > interface but no AF_NET. Works great on Ubuntu. Probably something simple > I'll keep debugging. The program I was running was the findalldevstest program, the source to which

[tcpdump-workers] live capture Ethernet gives me zero-packets

2011-04-03 Thread Andrej van der Zee
Hi, I am trying to get started with a live capture using libpcap. Somehow I cannot get the contents of a packet. It seems that all bytes are zeroed. Here is the source code: #include #include #include void callback(u_char * user, const struct pcap_pkthdr* pkthdr, const u_char * pkt) { fprin

Re: [tcpdump-workers] pcap_findalldevs, pcap_addr doesn't have AF_INET entries on OSX

2011-04-03 Thread Bob
Yes, I'm checking the whole linked list. I get an AF_LINK and AF_INET6 per interface but no AF_NET. Works great on Ubuntu. Probably something simple I'll keep debugging. -Rob On Apr 3, 2011, at 10:14 AM, Guy Harris wrote: > > On Apr 2, 2011, at 7:40 PM, Bob wrote: > >> Hello, I just noticed

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more than one extended counter sample

2011-04-03 Thread Michael Richardson
> "Rick" == Rick Jones writes: Rick> tcpdump 4.1.1, and 4.3.0-PRE-GIT_2011_04_01 prints just one Rick> expanded counter sample per captured PDU because it mistakenly Rick> skips forward sflow_sample_len when it has already adjusted Rick> tprt and tlen while it was printing the

Re: [tcpdump-workers] application/vnd.tcpdump.pcap assigned as MIME type for libpcap (and thus tcpdump, wireshark, ...)

2011-04-03 Thread Michael Richardson
Glen, thank you for stick handling this! Geoff Houston did a very nice presentation at v6ops at the IETF meeting last week about how much latent IPv6 there and the word "tcpdump" and "pcap capture" words were repeated regularly. It's always nice to know that important things are still being done

Re: [tcpdump-workers] pcap_findalldevs, pcap_addr doesn't have AF_INET entries on OSX

2011-04-03 Thread Guy Harris
On Apr 2, 2011, at 7:40 PM, Bob wrote: > Hello, I just noticed that no AF_INET address is returned when getting an > interface list (from pcap_findalldevs) on OSX even when an IPv4 address is > assigned to that interface. An AF_INET6 address is however returned. Is this > the expect behavior?

Re: [tcpdump-workers] pcap_findalldevs, pcap_addr doesn't have

2011-04-03 Thread Sam Roberts
On Sat, Apr 2, 2011 at 7:40 PM, Bob wrote: > Also, any suggestions for a cross-platform means of getting a MAC address > (AF_LINK). On BSD i can use socketaddr_dl from if_dl.h, but Linux doesn't > have this. I'm not even sure about windows. libnet has a libnet_get_hwaddr(), might work across yo