libpcap1.1.1 truncates UDP payload, ring buffer problem?

["mold2010" <mold2010 () tom com>]

Hi, All,
I have a problem about libpcap ring buffer. The problem is the packets captured by libpcap1.1.1 which uses ring 
buffer are truncated. The detail is as the following.
 
I have two machines. One is A, one is B. A and B are connected directly by twisted pair with Giga Ethernet NICs.I 
used tcpreplay to send packets from A to B and capture data with tcpdump for both A and B. I found many of packets whth 
UDP payload truncated for B, the receiver, but not for A. This problem is found for tcpdump4.1.1 with libpcap1.1.1.
 
I made the same test with tcpdump3.4 with libpcap0.9.4. This problem is not seen. The difference between these two 
tests are two libpcaps are different version. One is 0.9.4, which does not use ring buffer, one is 1.1.1, which used 
ring buffer.
 
The two machines are installed Suse Linux 10.2, the kernel is 2.6(I forgot the detail version info, if needed, I 
can add later).
 
I also tested to send data to B from C by LAN from another NIC. The libpcap is 1.1.1. This truncate problem is not 
seen. So the problem is related with NIC direct connection and libpcap ring buffer, I think. Till now I still can not 
figure out what is wrong. Maybe it is my NIC problem? But I found same problem when I send packets from B to A and 
capture packets at B. Is it a bug of libpcap 1.1.1? I think it is not. Maybe it is my NIC configuration 
problem? But I checked with ethtool and ifconfig and found nothing to add or change. The two GE NIC are working at 
1000Mbps full mode. Or it is a SuSe Linux bug? Anyone can help? Thanks a lot!
 
Roger   

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.