Re: [tcpdump-workers] semi-working tcpdump 3.4.0

2005-05-13 Thread Per Engelbrecht
Guy Harris wrote: Per Engelbrecht wrote: OK, so some issues with it might be the result of stuff the OpenBSD people have done. No they are by any standard brilliant, I'm the one using a shapshot for production. I've cvs to current and rebuilded the system and my problems are gone -

Re: [tcpdump-workers] semi-working tcpdump 3.4.0

2005-05-10 Thread Per Engelbrecht
Guy Harris wrote: Per Engelbrecht wrote: Hi all I'm having a peculiar problem with tcpdump (tcpdump version 3.4.0 / libpcap version 0.5) Those are very old versions - the current versions are 3.8.3 and 0.8.3. Are those the versions that came with OpenBSD? This is a pre-release snapshot,

[tcpdump-workers] semi-working tcpdump 3.4.0

2005-05-10 Thread Per Engelbrecht
Hi all I'm having a peculiar problem with tcpdump (tcpdump version 3.4.0 / libpcap version 0.5) on a OpenBSD 3.7 (20050404 snapshot) amd64. tcpdump with 0-2 flags = output. tcpdump with 3-x flags = no output. tcpdump with x flags and '-w' = non written no matter what. When 'tcpdump' is stopped I

Re: [tcpdump-workers] how to detect a bridged pseudo mac-addr.

2005-03-25 Thread Per Engelbrecht
Gert Doering wrote: Hi, On Fri, Mar 25, 2005 at 02:07:49AM +0100, Per Engelbrecht wrote: So fare I've done all my "tapping" on the backbone's SPAN port. I do have SPAN ports on all the customer switches as well, but don't use them right now - I'm building an NDIS

Re: [tcpdump-workers] how to detect a bridged pseudo mac-addr.

2005-03-24 Thread Per Engelbrecht
n a little temporary safety deserve neither liberty nor safety. -- Benjamin Franklin All emails are PGP signed; a lack of a signature indicates a forgery. On Thu, Mar 24, 2005 at 08:19:49AM +0100, Per Engelbrecht wrote: Hi all I have a big problem finding a customer with tcpdump (dedicated serve

[tcpdump-workers] how to detect a bridged pseudo mac-addr.

2005-03-23 Thread Per Engelbrecht
Hi all I have a big problem finding a customer with tcpdump (dedicated serverhosting / ~300 servers / switched network [mac-lockdown] / no "central" firewall other than my BGP-router protecting itself) who's spamming the world using a fake IP and a pseudo VMware mac-addr. in the mail-header. Th