[tcpdump-workers] Libpcap recieves partial packets (pcap_pkthdr.caplen

Hi, I develop a Linux sniffer application , which uses libpcap 1.2.0 library. The problem is that on some 2.6.16 and 2.4 kernel machines, which are pretty much "usual", SOMETIMES SOME packets are captured partially, i.e. tpacket_hdr structure tp_snaplen value is less then tp_len value. I see this r

Re: [tcpdump-workers] Libpcap recieves partial packets

Hi, Both machines are with Intel Gigabit Ethernet adapter, with different revisions, though. Both use e100e driver. So what you are actually saying, that NIC driver may handle it in a wrong way? If so, what are the possible reasons? How exactly you found out the driver ring frames size? Inserting