On Feb 8, 2012, at 8:28 PM, Gianluca Varenni wrote:
> We've run some more tests, and it looks like the problem is (obviously) not
> just with a snaplen of 1500.
>
> Here is what we found (using packets bigger than the snaplen):
>
> Snaplen = 59+16n -> caplen=58+16n
> Snaplen = 60+16n -> capl
pdump-workers-ow...@lists.tcpdump.org] On Behalf Of Guy Harris
Sent: Sunday, January 15, 2012 6:50 PM
To: tcpdump-workers@lists.tcpdump.org
Subject: Re: [tcpdump-workers] Snaplen (git-latest) not working properly on
linux
On Jan 15, 2012, at 6:44 PM, Gianluca Varenni wrote:
> Hi all.
>
>
On Jan 15, 2012, at 6:44 PM, Gianluca Varenni wrote:
> Hi all.
>
> It looks like there is a bug in handling a snaplen of 1500 on linux (with
> mmap on). If I set a snaplen of 1500 and receive packets > 1500 (e.g. 1514),
> libpcap returns only 1498 as caplen, and not 1500.
>
> Libpcap latest o
Hi all.
It looks like there is a bug in handling a snaplen of 1500 on linux (with mmap
on). If I set a snaplen of 1500 and receive packets > 1500 (e.g. 1514), libpcap
returns only 1498 as caplen, and not 1500.
Libpcap latest on git (1.3.0-PRE-GIT_2012_01_15)
Linux RHEL6, kernel 2.6.32-131.21.1.