Re: [tcpdump-workers] "not vlan" filter expression broken catastrophically!

2013-02-04 Thread Bill Fenner
On Sat, Feb 2, 2013 at 12:26 AM, Gianluca Varenni wrote: > What I'm talking about is not having the vlan keyword that has a global > effect to the whole filters. > At the moment we write something like "vlan and ip" to capture ip packets > within vlan, and a filter like "(vlan and ip) or udp" is

Re: [tcpdump-workers] "not vlan" filter expression broken catastrophically!

2013-02-04 Thread Bill Fenner
On Fri, Feb 1, 2013 at 8:07 PM, Michael Richardson wrote: > >> "Ani" == Ani Sinha writes: > Ani> hello folks : > > Ani> As you guys have been aware, I am hacking libpcap for a > Ani> while. Me and Bill noticed something seriously broken for any > Ani> filter expression that ha

Re: [tcpdump-workers] "not vlan" filter expression brokencatastrophically!

2013-02-04 Thread Rick Jones
On 02/04/2013 01:29 AM, David Laight wrote: I agree. Honestly I think a perfectly reasonable stance to take is requesting that the filters get packets *as seen on the wire/nic*. I think that's the mental model everyone uses, and any deviation from that model is prone to bugs in the kernel, libpca

Re: [tcpdump-workers] "not vlan" filter expression brokencatastrophically!

2013-02-04 Thread Ani Sinha
On Mon, Feb 4, 2013 at 1:29 AM, David Laight wrote: >> I agree. Honestly I think a perfectly reasonable stance to take is >> requesting that the filters get packets *as seen on the wire/nic*. I >> think that's the mental model everyone uses, and any deviation from >> that model is prone to bugs in

Re: [tcpdump-workers] "not vlan" filter expression brokencatastrophically!

2013-02-04 Thread David Laight
> I agree. Honestly I think a perfectly reasonable stance to take is > requesting that the filters get packets *as seen on the wire/nic*. I > think that's the mental model everyone uses, and any deviation from > that model is prone to bugs in the kernel, libpcap, and for the enduser. TX and RX seg