Re: tcpdump 4.0.0 + libpcap 1.0.0 Released

[Guy Harris <guy () alum mit edu>]

On Oct 29, 2008, at 1:16 PM, Tyson Key wrote:

> Also, is it considered normal for Linux 2.6.25 and above (or libpcap,
> although I'm not sure exactly what to blame) to truncate large  
> numbers of
> USB packets? (I assume this has been hashed to death on the list in  
> the
> past, though).

Paolo?  Could it be using the text interface rather than the binary  
interface?  I think I remember you indicating that the text interface  
doesn't supply the full packet.

Tyson, you said you were using the CVS version of libpcap (presumably  
meaning top-of-tree CVS, the pcap-usb-linux.c of which is identical to  
1.0's pcap-usb-linux.c), so presumably you built it from source.  You  
might want to stick some debugging printfs into usb_activate() to see  
whether it uses mmap access to the binary interface, non-mmap access  
to the binary interface, or the text interface.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.