Re: [tcpdump-workers] Research on tcpdump

2013-03-15 Thread Michael Richardson
> "Raymond" == Raymond Borges writes: Raymond> I'm doing research on tcpdump and I've been trying to Raymond> locate the source code for versions previous to 3.5.0 but Raymond> haven't had much luck. Do you know where I might find Raymond> these? Thank you. hi, 3.5 was releas

[tcpdump-workers] why the ethernet and ip header of packets, which are captured by libpcap function, are distorted

2013-03-15 Thread wen lui
I used libpcap function pcap_next() to capture some tcp packets I checked the bytes of the captured packets and notice that the ethernet and ip header of packets are distorted, in a mess with a lot 0's but the TCP header is fine what are potential reasons for this?

Re: [tcpdump-workers] why the ethernet and ip header of packets, which are captured by libpcap function, are distorted

2013-03-15 Thread Guy Harris
On Mar 15, 2013, at 9:07 AM, wen lui wrote: > I used libpcap function pcap_next() to capture some tcp packets I checked > the bytes of the captured packets and notice that the ethernet and ip > header of packets are distorted, in a mess with a lot 0's but the TCP > header is fine > > what are p

Re: [tcpdump-workers] Research on tcpdump

2013-03-15 Thread Guy Harris
On Mar 15, 2013, at 5:45 AM, Michael Richardson wrote: > Prior to that it would have been done by the LBL folks... the 3.4 > release was probably 3-4 years earlier.We have the CVS tree back to > the beginning, and it was imported into git, so there maybe some > evidence of what it looked lik

Re: [tcpdump-workers] why the ethernet and ip header of packets, which are captured by libpcap function, are distorted

2013-03-15 Thread Michael Richardson
> "wen" == wen lui writes: wen> I used libpcap function pcap_next() to capture some tcp packets wen> I checked the bytes of the captured packets and notice that the wen> ethernet and ip header of packets are distorted, in a mess with wen> a lot 0's but the TCP header is fine

Re: [tcpdump-workers] why the ethernet and ip header of packets, which are captured by libpcap function, are distorted

2013-03-15 Thread Guy Harris
On Mar 15, 2013, at 2:45 PM, Michael Richardson wrote: > >> "wen" == wen lui writes: >wen> I used libpcap function pcap_next() to capture some tcp packets >wen> I checked the bytes of the captured packets and notice that the >wen> ethernet and ip header of packets are distorted