Re: [tcpdump-workers] error-message "IP11 truncated-ip" in last tcpdump/libpcap

2004-07-13 Thread Guy Harris
On Jul 13, 2004, at 11:51 AM, Guy Harris wrote: whereas the traffic from 62.225.140.214 to 217.234.111.121 has Linux cooked capture IP with a protocol type of IP-inside-IP IP (with a bogus version number of 3 and a bogus header length of 8) The second capture is similar - an

Re: [tcpdump-workers] error-message "IP11 truncated-ip" in last tcpdump/libpcap

2004-07-13 Thread Guy Harris
On Jul 13, 2004, at 7:56 AM, Klaus Schrod wrote: Again our situation: Two computers connected to the net, one (lion) with a fixed ip address and one (styx) with pppoe. We established an ipsec tunnel between them successfully. tcpdump showed an error in the ESP traffic between styx and lion. But

Re: [tcpdump-workers] error-message "IP11 truncated-ip" in last tcpdump/libpcap

2004-07-13 Thread Klaus Schrod
Guy Harris wrote: On Mon, Jul 12, 2004 at 03:13:33PM +0200, Klaus Schrod wrote: Does anybody have any idea why we still get this error? Because, for whatever reason, the dissector for the protocol atop which the purported IP traffic is running thinks it's IP even though it isn't? (The version fiel

Re: [tcpdump-workers] error-message "IP11 truncated-ip" in last tcpdump/libpcap

2004-07-12 Thread Guy Harris
On Mon, Jul 12, 2004 at 03:13:33PM +0200, Klaus Schrod wrote: > Does anybody have any idea why we still get this error? Because, for whatever reason, the dissector for the protocol atop which the purported IP traffic is running thinks it's IP even though it isn't? (The version field has 11, not 4

[tcpdump-workers] error-message "IP11 truncated-ip" in last tcpdump/libpcap

2004-07-12 Thread Klaus Schrod
Hello, I created a new tcpdump 3.8.1 with libpcap 0.8.1 (last stable versions at sourgeforge). I tried to catch ipsec's ESP protocol traffic between two computers. One side is connected with a DSL router and a fixed ip address to the net and the other side is connected with pppoe. As a test I