Wireshark · Ethereal-users: RE: [Ethereal-users] Capture filter bug.

["McNutt, Justin M." <McNuttJ@xxxxxxxxxxxx>]

remove libpcap-0.6.2 source tree
untar libpcap-0.5.2 source tree
cd libpcap-0.5.2
./configure --prefix=/usr --enable-shared ; make ; make install
cd ../ethereal-0.8.15
make distclean
./configure --prefix=/usr --enable-shared ; make ; make install

Under linux-2.4.1, ethereal 0.8.15, libpcap 0.5.2, the problem does not
happen.  The problem *does* occur with libpcap 0.6.2.

Obviously for now, I should use libpcap 0.5 (I'll have to downgrade a few
systems).  Other suggestions?

--J

-----Original Message-----
From: Guy Harris
To: McNutt, Justin M.
Cc: 'ethereal-users@xxxxxxxxxxxx'
Sent: 2/22/01 4:17 PM
Subject: Re: [Ethereal-users] Capture filter bug.

> This problem seems new to me.  Does this have to do with libpcap-0.6.2
(as
> opposed to 0.5),

Possibly, as 0.6.2 uses the new PF_PACKET socket mechanism and, if
present, the Linux kernel socket filter mechanism.

> or the linux kernel (2.4.1 instead of 2.2.16)?

Possibly, although from brief looks at the packet-socket code, the
biggest change is the addition of memory mapping support, which 0.6.2
doesn't use.  (We'll probably add support at some point.)

Does your kernel have the socket filter option enabled?

I'd try it with:

	libpcap 0.5[.x]/tcpdump 3.5[.x];

	libpcap 0.6[.x]/tcpdump 3.6[.x];

to see if they both show the behavior or not.