Re: [tcpdump-workers] Snaplen (git-latest) not working properly on

2012-02-08 Thread Guy Harris
On Feb 8, 2012, at 8:28 PM, Gianluca Varenni wrote: > We've run some more tests, and it looks like the problem is (obviously) not > just with a snaplen of 1500. > > Here is what we found (using packets bigger than the snaplen): > > Snaplen = 59+16n -> caplen=58+16n > Snaplen = 60+16n -> capl

Re: [tcpdump-workers] Snaplen (git-latest) not working properly on

2012-02-08 Thread Gianluca Varenni
pdump-workers-ow...@lists.tcpdump.org] On Behalf Of Guy Harris Sent: Sunday, January 15, 2012 6:50 PM To: tcpdump-workers@lists.tcpdump.org Subject: Re: [tcpdump-workers] Snaplen (git-latest) not working properly on linux On Jan 15, 2012, at 6:44 PM, Gianluca Varenni wrote: > Hi all. > >

Re: [tcpdump-workers] Snaplen (git-latest) not working properly on linux

2012-01-15 Thread Guy Harris
On Jan 15, 2012, at 6:44 PM, Gianluca Varenni wrote: > Hi all. > > It looks like there is a bug in handling a snaplen of 1500 on linux (with > mmap on). If I set a snaplen of 1500 and receive packets > 1500 (e.g. 1514), > libpcap returns only 1498 as caplen, and not 1500. > > Libpcap latest o

[tcpdump-workers] Snaplen (git-latest) not working properly on linux

2012-01-15 Thread Gianluca Varenni
Hi all. It looks like there is a bug in handling a snaplen of 1500 on linux (with mmap on). If I set a snaplen of 1500 and receive packets > 1500 (e.g. 1514), libpcap returns only 1498 as caplen, and not 1500. Libpcap latest on git (1.3.0-PRE-GIT_2012_01_15) Linux RHEL6, kernel 2.6.32-131.21.1.