Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-28 Thread Michael Richardson
Rick, I've committed your pcap file and .out file. I edited the out file to remove the dates (-t option), and I suggest you want to generate one file for each -v level. It's pretty important for me to have the .pcap and .out file. You can run things directly as: cd tests ./TESTonce sflo

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-28 Thread Michael Richardson
> "Guy" == Guy Harris writes: >> The former is easy enough - attached is a compressed pcap file >> with 30 captured PDUs which can be used for testing. They are >> all just counter samples, there are no flow samples. Also >> attached is a compressed "cooked" file with the co

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-27 Thread Rick Jones
On Wed, 2011-04-27 at 15:21 -0400, Michael Richardson wrote: > Rick, I've committed your pcap file and .out file. > I edited the out file to remove the dates (-t option), and I suggest you > want to generate one file for each -v level. > > It's pretty important for me to have the .pcap and .out f

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-12 Thread Rick Jones
On Fri, 2011-04-08 at 17:04 -0700, Rick Jones wrote: > Either I fumbled trying the patch or something else has gone amis > because with a freshly cloned tcpdump, and a new set of sflows I get > output like: what has happened is I have switched switches and the switch I'm using is not sending the e

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-08 Thread Rick Jones
Either I fumbled trying the patch or something else has gone amis because with a freshly cloned tcpdump, and a new set of sflows I get output like: raj@tardy:~/tcpdump$ ./tcpdump -r /tmp/sflow.pcap -vvv reading from file /tmp/sflow.pcap, link-type EN10MB (Ethernet) 16:45:18.468863 IP (tos 0x0, ttl

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-05 Thread Rick Jones
On Mon, 2011-04-04 at 19:06 -0700, Guy Harris wrote: > On Apr 4, 2011, at 12:15 PM, Rick Jones wrote: > > > The former is easy enough - attached is a compressed pcap file with 30 > > captured PDUs which can be used for testing. They are all just counter > > samples, there are no flow samples. Al

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-05 Thread Rick Jones
On Mon, 2011-04-04 at 18:49 -0700, Guy Harris wrote: > On Apr 4, 2011, at 12:15 PM, Rick Jones wrote: > > > As for the latter, I don't have some of the pre-reqs installed: > > > > raj@tardy:~/tcpdump$ make check > > uudecode --help || (echo "No uudecode program found, not running tests"; > > echo

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-04 Thread Guy Harris
On Apr 4, 2011, at 12:15 PM, Rick Jones wrote: > The former is easy enough - attached is a compressed pcap file with 30 > captured PDUs which can be used for testing. They are all just counter > samples, there are no flow samples. Also attached is a compressed > "cooked" file with the correct o

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-04 Thread Guy Harris
On Apr 4, 2011, at 12:15 PM, Rick Jones wrote: > As for the latter, I don't have some of the pre-reqs installed: > > raj@tardy:~/tcpdump$ make check > uudecode --help || (echo "No uudecode program found, not running tests"; > echo "apt-get/rpm install sharutils?"; exit 1) > /bin/sh: uudecode: no

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-04 Thread Rick Jones
On Sun, 2011-04-03 at 20:27 +0200, Michael Richardson wrote: > > "Rick" == Rick Jones writes: > Rick> tcpdump 4.1.1, and 4.3.0-PRE-GIT_2011_04_01 prints just one > Rick> expanded counter sample per captured PDU because it mistakenly > Rick> skips forward sflow_sample_len when it ha

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more

2011-04-04 Thread Rick Jones
On Fri, 2011-04-01 at 20:11 -0700, Guy Harris wrote: > On Apr 1, 2011, at 6:03 PM, Rick Jones wrote: > > > tcpdump 4.1.1, and 4.3.0-PRE-GIT_2011_04_01 prints just one expanded > > counter sample per captured PDU because it mistakenly skips forward > > sflow_sample_len when it has already adjusted

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more than one extended counter sample

2011-04-03 Thread Michael Richardson
> "Rick" == Rick Jones writes: Rick> tcpdump 4.1.1, and 4.3.0-PRE-GIT_2011_04_01 prints just one Rick> expanded counter sample per captured PDU because it mistakenly Rick> skips forward sflow_sample_len when it has already adjusted Rick> tprt and tlen while it was printing the

Re: [tcpdump-workers] [PATCH] print-sflow.c - actually print more than one extended counter sample

2011-04-01 Thread Guy Harris
On Apr 1, 2011, at 6:03 PM, Rick Jones wrote: > tcpdump 4.1.1, and 4.3.0-PRE-GIT_2011_04_01 prints just one expanded > counter sample per captured PDU because it mistakenly skips forward > sflow_sample_len when it has already adjusted tprt and tlen while it was > printing the sample contents. Thi

[tcpdump-workers] [PATCH] print-sflow.c - actually print more than one extended counter sample

2011-04-01 Thread Rick Jones
tcpdump 4.1.1, and 4.3.0-PRE-GIT_2011_04_01 prints just one expanded counter sample per captured PDU because it mistakenly skips forward sflow_sample_len when it has already adjusted tprt and tlen while it was printing the sample contents. This then leaves it confused about what it is seeing. Shift