Re: [tcpdump-workers] Request for new Link-layer header type

2011-09-15 Thread Guy Harris
On Sep 14, 2011, at 1:16 AM, Guy Harris wrote: > In any case, I've assigned 240 as > DLT_ETHERNET_HILSCHER/LINKTYPE_ETHERNET_HILSCHER, for non-transparent packets > (with the 4-byte pseudo-header before the Ethernet header, but without the > preamble or SFD), and 241 as > DLT_ETHERNET_HILSCHE

[tcpdump-workers] answer to ping package

2011-09-15 Thread Julius
Hi, im looking for a tool that can answer a ping on a windows machine send by some application or redirect the traffic to a vpn and rewrite the source address when the answer arrives. the program in question sends a ping to see if something is up, this is a problem because our network blocks

Re: [tcpdump-workers] Request for new Link-layer header type

2011-09-15 Thread Guy Harris
On Aug 31, 2011, at 4:03 AM, wrote: > Unfortunately there is no document online, but the structure is quite simple, > it's just a 32-bit value containing some bit fields: > > typedef struct > { > uint32_tuiErrorCode : 8; > uint32_tuiGpio: 1; > uint

Re: [tcpdump-workers] questions on -B, performance, mbufs, and

2011-09-15 Thread Guy Harris
On Sep 15, 2011, at 9:54 AM, Jon Schipp wrote: > I'm trying to use the -B option this time but it's not working > for me, tcpdump just prints the help menu. > tcpdump -B 200 -nni em0 -s0 -w test.txt > I've tried other values as well e.g. 524288, 1048576. It doesn't like any of > them. *I'm o

Re: [tcpdump-workers] questions on -B, performance, mbufs, and

2011-09-15 Thread Jon Schipp
Hello Guy, Thanks for the response, you've helped me a great deal. I increased the libpcap buffer size by incrementing the value in net.bpf.size/maxsize. Test1: capture 24 hours with no buffer or OS changes(bpf size = 4096, max size = 524288), tcpdump with -nn -w -s0 Result: Captured 47,086,090

Re: [tcpdump-workers] Suggestion: Pcap-over-IP client support in

2011-09-15 Thread rixed
-[ Wed, Sep 14, 2011 at 09:56:59AM -0700, Rick Jones ] > What are the issues/benefits/downfalls one way or t'other between the > two schemes - over ssh and a specific connection - when it comes to > making certain that this thing forwarding captured traffic isn't simply > chasing its own tai