Re: [tcpdump-workers] BPF questions...

2011-05-21 Thread Guy Harris
On May 21, 2011, at 9:09 AM, barcaroller wrote: > This may not be the right group, but I have a few BPF questions that I hope > you can answer: > > * What is the maximum size of a BPF expression that can be passed to tcpdump > and pcap_compile()? pcap_compile() has no inherent limit; the only

[tcpdump-workers] BPF questions...

2011-05-21 Thread barcaroller
This may not be the right group, but I have a few BPF questions that I hope you can answer: * What is the maximum size of a BPF expression that can be passed to tcpdump and pcap_compile()? Some of the BPF expressions I've observed are over 1024 characters and I wonder what the limt is (if any