-[ Mon, May 23, 2011 at 12:38:43AM -0700, Guy Harris ]---- > > On May 23, 2011, at 12:31 AM, ri...@happyleptic.org wrote: > > > Which brings the question: how one could find out the MTU of a > > pcap_handle in order no to set caplen to 65535 ? > > See pcap-linux.c in the top of the trunk or of the 1.2 branch. (Short > answer: SIOCGIFMTU, as in the iface_get_mtu() routine.)-
If I understand this code correctly, in the next release of the libpcap if a client program ask for a capture length bigger than the MTU then the size allocated for each frame in the ring buffer will be sized down to avoid wasting space ? If so then I just have to wait for the new libpcap :-) - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
