Re: question regarding bpf_program

["Prashant Batra (prbatra)" <prbatra () cisco com>]

-----Original Message-----
From: tcpdump-workers-owner () lists tcpdump org
[mailto:tcpdump-workers-owner () lists tcpdump org] On Behalf Of Guy Harris
Sent: Sunday, February 05, 2012 12:23 PM
To: tcpdump-workers () lists tcpdump org
Subject: Re: [tcpdump-workers] question regarding bpf_program


On Feb 4, 2012, at 8:18 PM, Prashant Batra (prbatra) wrote:

> [Prashant] Thanks, but I used the same device to check this.

Then you must have disabled the optimizer, or used different versions of
libpcap, or something.
[Prashant] Thanks, this was the reason. After enabling optimization in
the pcap_compile, I got the same filter.
[Prashant] I guess tcpdump has default optimization set.
What was the exact tcpdump command you used with "-d" - just "tcpdump
-d", or did you specify a "-i" flag?

What is the output of "tcpdump -h"?

In your program, what was the name of the device you used in
pcap_open_live() or pcap_create()?

If you modify your program to do

        printf("%s\n", pcap_lib_version());

what does it print?

What were the exact arguments you passed to pcap_compie()?

> I will be happy to unsubscribe, but there is no mailing-list on
tcpdump/libpcap
> users.
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.

That message is appended to all tcpdump-workers mailing list messages -
including, as you can see here, yours.
[Prashant] Sorry for wrong interpretation.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.