On Apr 7, 2006, at 10:08 AM, Rick Jones wrote:
As for checking against the normal MTU, does tcpdump/libpcap have that information?
Only to the extent that it could infer that from the link-layer type. (Jumbo frames might make that tricky.)
Does libpcap/tcpdump have any way of knowing that this packet originated on the system where libpcap/tcpdump was running?
Libpcap could do that on some OSes, but there's currently no way of supplying that information to tcpdump. There's also currently nothing in the libpcap file format for that (although with pcap-NG, the latter should be possible, and the API changes to make that available could allow it to be made available for live captures as well as savefiles).
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
