Re: [tcpdump-workers] Buffer overwrites with pcap_next_ex

Hi, thank you very much, I was already despairing of that issue, best regards, Andreas Guy Harris schrieb: > > On Jan 25, 2009, at 2:05 AM, Andreas Rieke wrote: > >> I have forgotten to mention that I use libpcap 1.0.0. > > ...which means that, at least on Linux, lib

Re: [tcpdump-workers] Buffer overwrites with pcap_next_ex

Hi, I have forgotten to mention that I use libpcap 1.0.0. Guy Harris schrieb: > > On Jan 24, 2009, at 6:36 AM, Andreas Rieke wrote: > >> I have seen a strange behavior of pcap_next_ex where a buffer is >> overwritten. When pcap_next_ex has finished, it returns a buffer for

[tcpdump-workers] Buffer overwrites with pcap_next_ex

Hi, I have seen a strange behavior of pcap_next_ex where a buffer is overwritten. When pcap_next_ex has finished, it returns a buffer for the packet header and one for the packet data. When processing the packet data, I have often seen strange data. For that reason, I have changed my code to copy

[tcpdump-workers] pcap performance question

load. If you had to solve this problem, which way would you go? - Are there any restrictions concerning the filter expression (length, complexity)? - Which approach is the more stable one? - Which approach is the more performant one? Thanks in advance, Andreas -- Dr. Andreas Rieke

[tcpdump-workers] Is pcap thread-safe?

Hi there, is pcap really thread-safe, especially under linux? Did anybody really try to run it on multiple interfaces, one per thread? Thanks, Andreas - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

[tcpdump-workers] Capture on many interfaces with pcap

Hi, I am using pcap/WinPcap to capture traffic on linux and windows operating systems. I need to work on several interfaces in parallel and expect high load, however, as the filter function should drop more than 99 percent of the traffic, receiving packets from pcap should not be the problem. My d