Re: [tcpdump-workers] standard pcap-1.0.0 with mmap?

Ok，I know it， thanks！ 在2010-02-23?10:18:52，"Guy?Harris"??写道： > >On?Feb?22,?2010,?at?5:40?PM,?d00fy?wrote: > >>?Does?pcap-1.0.0?use?mmap?to?copy?packets?from?kernel?space?to?user?spcace?as?default? > >If?it's?compiled?on > > > 1)?a?Linux?distr

[tcpdump-workers] standard pcap-1.0.0 with mmap?

Does pcap-1.0.0 use mmap to copy packets from kernel space to user spcace as default? or should config it explicitly? - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] packets captured with

thanks for your help. Now I know what the header means. 在2009-11-17，"Guy Harris" 写道： > >On Nov 15, 2009, at 11:56 PM, d00fy wrote: > >> hi all, recently I captured packets from ethernet with libpcap, I >> found out that packets which were caputred with >>

[tcpdump-workers] packets captured with pcap_open_live("any", ...) seem like strange

hi all, recently I captured packets from ethernet with libpcap, I found out that packets which were caputred with pcap_open_live("any", ...)seem like strange, there are two bytes new at mac header, for instance: 00 00 00 01 00 06 00 1e c9 56 f8 a2 f1 00 08 00 but packets which were captured w