[tcpdump-workers] Re: v4/v6 packet length printing inconsistency

2025-07-02 Thread Gert Doering
Hi, On Wed, Jul 02, 2025 at 03:28:59PM -0400, Michael Richardson wrote: > > Gert Doering wrote: > > I've been writing a document explaining inside/outside fragmentation in > > an OpenVPN context, explaining my points with "tcpdump", like this: > >

[tcpdump-workers] Re: v4/v6 packet length printing inconsistency

2025-07-01 Thread Gert Doering
Hi, On Mon, Jun 30, 2025 at 06:03:49PM +0200, Gert Doering wrote: > How do you prefer to receive patches these days? MR on Github? Patch on > the list? (I'm a bit out of the loop wrt tcpdump contributions). So, I found CONTRIBUTING.md, and tried my best to follow it. The change i

[tcpdump-workers] Re: v4/v6 packet length printing inconsistency

2025-06-30 Thread Gert Doering
very confused to see functioning "-g" code in there... and then I looked at git log ;-) So - will take that into account for print-ip6.c gert -- "If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Neve

[tcpdump-workers] Re: v4/v6 packet length printing inconsistency

2025-06-30 Thread Gert Doering
Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany g...@greenie.muc.de ___ tcpdump-workers

[tcpdump-workers] v4/v6 packet length printing inconsistency

2025-06-30 Thread Gert Doering
umor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany g...@greenie.muc.de ___ tcpdump-workers mailing list -- tcpdump-workers@lists.tcpdump.org To unsu

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-08 Thread Gert Doering
ill I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany g...@greenie.muc.de ___ tcpdump-workers mailing list -- tcpd

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-07 Thread Gert Doering via tcpdump-workers
honest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany g...@greenie.muc.de --- End Message --- ___

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-07 Thread Gert Doering via tcpdump-workers
oubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany g...@greenie.muc.de --- End Message ---

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-07 Thread Gert Doering via tcpdump-workers
his would need a man page patch as well :) ) gert -- "If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor."

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-07 Thread Gert Doering via tcpdump-workers
sibly call "(p)", not "(bp)". Copy-pasted that line from print-gre.c, and only changed the first "bp" to "p. gert -- "If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Ne

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-05 Thread Gert Doering via tcpdump-workers
uot;If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The M

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-05 Thread Gert Doering via tcpdump-workers
--- Begin Message --- Hi, On Tue, May 05, 2020 at 07:28:28PM +0200, Francois-Xavier Le Bail wrote: > On 05/05/2020 12:15, Gert Doering via tcpdump-workers wrote: > > In my case, there is an MPLS control word before the ethernet header > > (" "), and if I skip that

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-05 Thread Gert Doering via tcpdump-workers
took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Mu

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-05 Thread Gert Doering via tcpdump-workers
a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany g...@greenie.muc.de --- End Message --- ___ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-05 Thread Gert Doering via tcpdump-workers
--- Begin Message --- Hi, On Tue, May 05, 2020 at 04:45:04PM +0200, Francois-Xavier Le Bail wrote: > On 05/05/2020 12:15, Gert Doering via tcpdump-workers wrote: > > 12:11:46.116238 MPLS (label 105, exp 0, ttl 254) (label 24003, exp 0, [S], > > ttl 254) IP 10.27.99.2 > 10.2

Re: [tcpdump-workers] decode MPLS-contained packets?

2020-05-05 Thread Gert Doering via tcpdump-workers
--- Begin Message --- Hi, On Tue, May 05, 2020 at 05:50:40AM -0400, Gert Doering via tcpdump-workers wrote: > Now, the two questions: > > - is there a switch I'm missing to decode packets-in-MPLS? > (like, "packets in GRE" get decoded already) > - if not, is

[tcpdump-workers] decode MPLS-contained packets?

2020-05-05 Thread Gert Doering via tcpdump-workers
eady working on it? I might just hack it in, if not... thanks :) gert -- "If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor

Re: [tcpdump-workers] Legacy non-Linux support

2019-10-07 Thread Gert Doering
onest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany g...@greenie.muc.de ___ tcpdump-

Re: [tcpdump-workers] [tcpdump-security] [libpcap] Problem with version 1.9.0

2018-07-23 Thread Gert Doering
gert -- "If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh

Re: [tcpdump-workers] BUG FOUNDED (CANT STOP PROCESS)

2016-12-08 Thread Gert Doering
ot interfere with special characters. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89-35655025g...@net.informatik.tu-muenchen.de ___

Re: [tcpdump-workers] How to check if pcap_t is really free?

2013-06-20 Thread Gert Doering
Hi, On Thu, Jun 20, 2013 at 10:36:27PM +0300, Nadav Vinik wrote: > On 20 June 2013 20:16, Gert Doering wrote: > > > > On Thu, Jun 20, 2013 at 07:44:00PM +0300, Nadav Vinik wrote: > > > After pcap_close handle is not NULL since the following printf is not > > print

Re: [tcpdump-workers] How to check if pcap_t is really free?

2013-06-20 Thread Gert Doering
//www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89-35655025g...@net.informatik.tu-muenchen.de ___ tcpdump-workers ma

Re: [tcpdump-workers] incorrect tcp checksum on Linux tun interfaces?

2012-12-04 Thread Gert Doering
Hi, On Tue, Dec 04, 2012 at 11:09:43AM -0500, Michael Richardson wrote: > {sorry if I'm a bit tardy at removing the emergency moderation that I > turned on in order to keep junk off the list} I understand that, which I wasn't bugging anyone about this :-) > >>>>&

[tcpdump-workers] incorrect tcp checksum on Linux tun interfaces?

2012-12-04 Thread Gert Doering
mentation-offload: off generic-segmentation-offload: off generic-receive-offload: on large-receive-offload: off rx-vlan-offload: off tx-vlan-offload: off ntuple-filters: off receive-hashing: off ... weird. gert -- USENET is *not* the non-clickable part of WWW!

Re: [tcpdump-workers] Multifile patch

2012-09-04 Thread Gert Doering
example). > I'd have thought that doing: > VFile=stdin; > > was the best way? This is well-defined. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany

Re: [tcpdump-workers] tcpdump dissector for IP protocol 97 (EtherIP)?

2011-04-28 Thread Gert Doering
Hi, On Wed, Apr 27, 2011 at 03:25:40PM -0400, Michael Richardson wrote: > >>>>> "Gert" == Gert Doering writes: > Gert> is someone already working on a tcpdump dissector for IP > Gert> protocol 97 (ethernet tunneled over IP, RFC 3378)? > >

[tcpdump-workers] tcpdump dissector for IP protocol 97 (EtherIP)?

2011-04-16 Thread Gert Doering
), but want to avoid duplication of work. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89-35655025g.

Re: [tcpdump-workers] bandwidth by user or process id

2010-10-06 Thread Gert Doering
//www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89-35655025g...@net.informatik.tu-muenchen.de - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] bandwidth by user or process id

2010-10-05 Thread Gert Doering
is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89-35655025g...@net.informatik.tu-muenchen.de - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] tcp sequence and ack number with libpcap

2010-08-19 Thread Gert Doering
that, you need to user > ntohl(), not htonl(). On standard platforms with byte order 1234 or 4321, there is no difference. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany

Re: [tcpdump-workers] tcp sequence and ack number with libpcap

2010-08-19 Thread Gert Doering
ow the deltas "how many bytes sent/acked since the beginning of the flow", instead of the absolute numbers. >From a brief glance, your code looks fine to me. gert -- USENET is *not* the non-clickable part of WWW!

Re: [tcpdump-workers] deduct local IP address from cap-file

2010-05-03 Thread Gert Doering
nd is just forwarding this packet on behalf of others. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89-3565502

Re: [tcpdump-workers] forces (and sctp) patch

2010-01-19 Thread Gert Doering
debugging network issues caused by packet loss / reordering. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89

Re: [tcpdump-workers] Libpcap on VMWare

2010-01-13 Thread Gert Doering
-- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89-35655025g...@net.informatik.tu-muenchen.de - This is the

Re: [tcpdump-workers] does "port 25" work?

2008-08-02 Thread Gert Doering
r-PPPoE-on-a-VLAN and all the other possible variants of packet tunnels... I'd rather not go that way. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany

Re: [tcpdump-workers] does "port 25" work?

2008-08-01 Thread Gert Doering
USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] Should we enable IPv6 support by default?

2008-02-06 Thread Gert Doering
Hi, On Wed, Feb 06, 2008 at 12:58:49PM -0800, Guy Harris wrote: > Gert Doering wrote: > > >tcpdump is not actually *doing* any IPv6. > It's doing IPv6 name resolution. OK, good argument. Some IPv6 related stuff without actually sending IPv6 packets (unless the reso

Re: [tcpdump-workers] Should we enable IPv6 support by default?

2008-02-06 Thread Gert Doering
IPv6 support?". It's not like tcpdump is trying to actually *use* IPv6. (I can do tcpdump to look at "spanning tree" packets. Or Cisco CDP. Neither is supported in my operating system...) gert -- USENET is *not* the non-clickable part of WWW!

Re: [tcpdump-workers] Should we enable IPv6 support by default?

2008-02-06 Thread Gert Doering
s *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] [patch] Teach tcpdump to recognize new OpenBSD pflog packets

2007-09-28 Thread Gert Doering
) but not upgrading applications that use libpcap at the same time, like "wireshark from the ports". Would the pflog change then break the applications? gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Ge

Re: [tcpdump-workers] segfault in libpcap

2007-01-30 Thread Gert Doering
ble part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://cod.sande

Re: [tcpdump-workers] tcpdump output format

2006-03-08 Thread Gert Doering
n-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] misprinting of GRE tunneled packets on NetBSD Sparc64

2005-07-26 Thread Gert Doering
Hi, On Tue, Jul 26, 2005 at 06:08:44PM +0200, Gert Doering wrote: > On Tue, Jul 26, 2005 at 05:45:15PM +0200, Hannes Gredler wrote: > > > i am anticipating a kernel issue - > > typically we get this error message when the kernel tells us > > that the payload is IPv4

Re: [tcpdump-workers] misprinting of GRE tunneled packets on NetBSD Sparc64

2005-07-26 Thread Gert Doering
fferent route, so this might also explain the different behaviour seen. In that case I take all the blaim and go fix it :-) gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

[tcpdump-workers] misprinting of GRE tunneled packets on NetBSD Sparc64

2005-07-26 Thread Gert Doering
this down, and get it fixed / fix it? gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EM

Re: [tcpdump-workers] print GRE over IPv6 packets

2005-07-03 Thread Gert Doering
upport for RSVP over IPv6; - /hannes Thanks. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025

Re: [tcpdump-workers] print GRE over IPv6 packets

2005-07-02 Thread Gert Doering
Hi, On Sat, Jul 02, 2005 at 11:45:56AM +0200, Gert Doering wrote: > I'm working on adding Cisco-compatible GRE over IPv6 tunneling, and ... to NetBSD, that is :-) (just in case you were wondering "adding *to what*?"). gert -- USENET is *not* the non-cli

[tcpdump-workers] print GRE over IPv6 packets

2005-07-02 Thread Gert Doering
; -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] fddipad on NetBSD

2005-04-07 Thread Gert Doering
o some testing on 2.0.2 on Sparc64. I also have -current sources here, to check header file changes or whatever. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany

Re: [tcpdump-workers] how to detect a bridged pseudo mac-addr.

2005-03-25 Thread Gert Doering
tcpdump-workers. A better list for that might be cisco-nsp (see http://puck.nether.net/ for a number of very interesting networker lists). gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germ

Re: [tcpdump-workers] TCPDUMP version 3.8.3

2005-03-22 Thread Gert Doering
ALWAYS clean up and return all memory. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] can't do CVS checkouts/updates anymore

2005-02-08 Thread Gert Doering
cal patches" is very cumbersome. But thankfully, this issue is being resolved :-) gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] f

Re: [tcpdump-workers] filters for wireless packets

2005-02-08 Thread Gert Doering
umber of received packets. Can you show a dump of a few packets flowing back and forth? gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL

Re: [tcpdump-workers] can't do CVS checkouts/updates anymore

2005-02-08 Thread Gert Doering
SENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] can't do CVS checkouts/updates anymore

2005-02-07 Thread Gert Doering
oject's web server" all too well... > If you (or anyone else) wants to send their IP address, I can insert it > into hosts.allow. I'll even take /24s if you don't have a static. Please add 193.149.48.160/27 for me (Gert Doering, [EMAIL PROTECTED]). This /27 is statically

Re: [tcpdump-workers] can't do CVS checkouts/updates anymore

2005-02-07 Thread Gert Doering
gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

[tcpdump-workers] can't do CVS checkouts/updates anymore

2005-02-03 Thread Gert Doering
*not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [EMAIL PROTECTED] fax: +49-89-35655025[EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.