[tcpdump-workers] pcap_inject change?

2018-09-11 Thread Steve Bourland
I am expecting this is a change outside of libpcap given the lack of a note in the change log, but we are moving from Ubuntu 16.04 (well, really 12.04) to 18.04 and have starting having packets flagged for Frame Check Sequence errors when captured and analyzed in Wireshark. I have a simple ARP

Re: [tcpdump-workers] pcap_inject change?

2018-09-11 Thread Steve Bourland
On Tue, 11 Sep 2018, Michael Richardson wrote: Steve Bourland wrote: > are captured, if called with size argument 60, 74 are captured). On > matching hardware under Ubuntu 16.04 (libpcap 1.7.4), pcap_inject with > size 50 results in 60 bytes on the wire (expected minimum packet size)

Re: [tcpdump-workers] pcap_inject change?

2018-09-11 Thread Steve Bourland
On Tue, 11 Sep 2018, Michael Richardson wrote: Steve Bourland wrote: > are captured, if called with size argument 60, 74 are captured). On > matching hardware under Ubuntu 16.04 (libpcap 1.7.4), pcap_inject with > size 50 results in 60 bytes on the wire (expected minimum packet size)

Re: [tcpdump-workers] pcap_inject change?

2018-09-11 Thread Steve Bourland
On Tue, 11 Sep 2018, Michael Richardson wrote: Steve Bourland wrote: > I'm a little confused, why would the capture mechanism matter for the > pcap_inject call? I am capturing both senders packets on the same > machine (a single tcpdump call). I was thinking my next move would be

Re: [tcpdump-workers] pcap_inject change?

2018-09-11 Thread Michael Richardson
Steve Bourland wrote: > Yes, things broke moving from 4.15.0-32 to 4.15.0-34, so it looks like > the change came with the move from -32 to -33 (the original machines > showing the problem have the -33 kernel installed). > These kernels are what come with Ubuntu 18.04 from Canonica