On Apr 1, 2005, at 2:56 AM, Gabriel wrote:
Yes, it works when I use the -O option. Thanks.
So it's probably an optimizer bug, and...
The output of the first one is: --------- [EMAIL PROTECTED]:~> sudo tcpdump -d -i eth0 "tcp[2:2]>=1000 and tcp[2:2]<=2000" (000) ldh [12] (001) jeq #0x800 jt 2 jf 12 (002) ldb [23] (003) jeq #0x6 jt 4 jf 12 (004) ldh [20] (005) jset #0x1fff jt 12 jf 6 (006) ldxb 4*([14]&0xf) (007) ldh [x + 16] (008) ldx #0x3e8 (009) jge x jt 10 jf 12 (010) jgt x jt 12 jf 11 (011) ret #96 (012) ret #0
...that sure looks like the optimizer bug in action (the "optimized" code is comparing against 0x3e8, i.e. 1000, but not against 2000).
I'm using libcap 0.8.3 which is the latest version afaik.
It is the latest released version...
Don't know if it's bug-free though.
...and it's *definitely* not bug-free, as per the above. The current top-of-tree CVS version (and the "current tar files" version, which is a nightly snapshot of the top-of-tree CVS version) has that bug fixed.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
