Re: [tcpdump-workers] Running TCPDUMP over a web interface

2011-09-08 Thread Chris Morgan
Depending on the method of usage it should be reasonable to whip up a php page with some jquery to handle the requests. I'm not sure about how the the information from tcpdump would be conveyed, either via a file or stdout, and what kinds of ways the user would interact with the system, via a pseud

Re: [tcpdump-workers] Release schedule?

2010-04-01 Thread Chris Morgan
I've got a couple of Oss projects that I release and ended up writing some bash scripts that I keep in a subdir of the code repo that build source and release packages given a version number. They even use git log to build the release notes from a tag. I can share if interested since I had the sam

Re: [tcpdump-workers] How to tell if application is handling packets

2009-12-26 Thread Chris Morgan
On Sat, Dec 26, 2009 at 6:53 PM, Guy Harris wrote: > > On Dec 26, 2009, at 3:13 PM, Chris Morgan wrote: > >> Ahh, so ps_drop might work for this. >> >> Users are reporting issues on Windows with the latest winpcap release >> but I do a lot of my testing under Li

Re: [tcpdump-workers] How to tell if application is handling packets

2009-12-26 Thread Chris Morgan
On Sat, Dec 26, 2009 at 5:02 PM, Guy Harris wrote: > > On Dec 26, 2009, at 9:27 AM, Chris Morgan wrote: > >> I have a case where it appears that packets are being missed or >> dropped. I wonder if this is due to too much processing being done in >> the pcap_dispatch() h

[tcpdump-workers] How to tell if application is handling packets too slowly, causing them to be missed?

2009-12-26 Thread Chris Morgan
I have a case where it appears that packets are being missed or dropped. I wonder if this is due to too much processing being done in the pcap_dispatch() handler in my application in cases where there are bursts of packets like facebook chat messages or website visits. My question is how to detect

Re: [tcpdump-workers] Is libpcap pcap_set_buffer_size() == winpcap

2009-09-03 Thread Chris Morgan
On Thu, Sep 3, 2009 at 1:53 PM, Guy Harris wrote: > > On Sep 3, 2009, at 10:20 AM, Chris Morgan wrote: > >> I'm asking the user if pcap_set_buffer_size() will work for them. If >> it does we can implement that interface and we'll be able to have the >> same a

Re: [tcpdump-workers] Is libpcap pcap_set_buffer_size() == winpcap

2009-09-03 Thread Chris Morgan
On Thu, Sep 3, 2009 at 1:04 PM, Guy Harris wrote: > > On Sep 3, 2009, at 9:13 AM, Chris Morgan wrote: > >> A user of Sharppcap is asking if we support pcap_setbuff(). Apparently >> this is a winpcap specific option. > > Yes. > > The problem is that not all plat

[tcpdump-workers] Is libpcap pcap_set_buffer_size() == winpcap pcap_setbuff() ?

2009-09-03 Thread Chris Morgan
Hello. A user of Sharppcap is asking if we support pcap_setbuff(). Apparently this is a winpcap specific option. I was wondering if pcap_set_buffer_size() was the same as pcap_setbuff(). If so, are there any plans to unify the api for increased cross platform code portability? Chris - This is the

Re: [tcpdump-workers] pcap_next/pcap_dispatch on VMware vmnet

2009-03-10 Thread Chris Morgan
On Tue, Mar 10, 2009 at 9:01 PM, Guy Harris wrote: > > On Mar 10, 2009, at 5:40 PM, Chris Morgan wrote: > >> Hmm. Yeah I'll make sure to put in a comment about mac os support. > > Note that select() *does* work with BPF devices on OS X - modulo the > traditional BPF

Re: [tcpdump-workers] pcap_next/pcap_dispatch on VMware vmnet

2009-03-10 Thread Chris Morgan
On Tue, Mar 10, 2009 at 8:02 PM, Guy Harris wrote: > > On Mar 10, 2009, at 9:52 AM, Chris Morgan wrote: > >> Does mac osx have epoll? > > No.  It has poll(), but that, as noted, doesn't work with character special > files, such as the BPF devices used for traffic cap

Re: [tcpdump-workers] pcap_next/pcap_dispatch on VMware vmnet

2009-03-10 Thread Chris Morgan
On Tue, Mar 10, 2009 at 3:32 AM, Guy Harris wrote: > Chris Morgan wrote: >> On Mon, Mar 9, 2009 at 7:51 PM, Guy Harris wrote: >>> Well, the first question is "why is blocking forever an issue?" >>> >>> Is the application also going to, for example,

Re: [tcpdump-workers] pcap_next/pcap_dispatch on VMware vmnet device

2009-03-09 Thread Chris Morgan
On Mon, Mar 9, 2009 at 7:51 PM, Guy Harris wrote: > > On Mar 9, 2009, at 4:10 PM, Chris Morgan wrote: > >> Opening a live capture as root (using sudo), on a vmware bridge device >> on Linux 2.6.27, using a timeout of 1000ms. I'm seeing pcap_next() and >> pcap_disp

[tcpdump-workers] pcap_next/pcap_dispatch on VMware vmnet device not timing out

2009-03-09 Thread Chris Morgan
Opening a live capture as root (using sudo), on a vmware bridge device on Linux 2.6.27, using a timeout of 1000ms. I'm seeing pcap_next() and pcap_dispatch() getting stuck reading, no timeouts are occurring. Is there a robust and efficient way of reading packets that won't block forever like this?

Re: [tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-04 Thread Chris Morgan
On Wed, Mar 4, 2009 at 1:21 PM, Guy Harris wrote: > > On Mar 4, 2009, at 9:19 AM, Gianluca Varenni wrote: > >> In the case of Windows/WinPcap, we have an internal Packet API to get the >> MAC address, the main problem is exposing such MAC address at the pcap API >> level. I actually didn't know th

Re: [tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Chris Morgan
On Tue, Mar 3, 2009 at 9:54 PM, Guy Harris wrote: > > On Mar 3, 2009, at 6:44 PM, Chris Morgan wrote: > >> I would be looking for the local adapter mac addresses.  Under linux >> with pcap and the adapters I have, ethernet and wireless, I see >> hardware mac addresse

Re: [tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Chris Morgan
On Tue, Mar 3, 2009 at 8:49 PM, Michael Richardson wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > >>>>>> "Chris" == Chris Morgan writes: >    Chris> I'm working on a pcap/winpcap c# library, SharpPcap. I was >    Chris> won

[tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Chris Morgan
I'm working on a pcap/winpcap c# library, SharpPcap. I was wondering what the best way to get a devices mac address was, preferrably in a manner that would work in both pcap and with winpcap. So far I've seen code that captures packets on the interface and looks in them for the mac address, I've al

Re: [tcpdump-workers] ipv6 addresses in pcap_addr

2009-01-22 Thread Chris Morgan
On Thu, Jan 22, 2009 at 7:59 PM, Guy Harris wrote: > > On Jan 22, 2009, at 4:05 PM, Chris Morgan wrote: > >> Hello. >> >> I wasn't sure if this question was answered anywhere, I've searched >> via google and looked on the mailing lists but haven'

[tcpdump-workers] ipv6 addresses in pcap_addr

2009-01-22 Thread Chris Morgan
Hello. I wasn't sure if this question was answered anywhere, I've searched via google and looked on the mailing lists but haven't seen any answers. How does one get a ipv6 address from the sockaddr struct pointed to by pcap_addr? I have devices with addresses of type AF_INET6 but since the sockad