I've just patch my libpcap to use the Linux Socket Filter (lsf).
I have recompiled my kernel, but now when I use tcpdump I have :
9:04:48.292428 arp who-has guadeloupe.sr.epita.fr tell garp
19:04:48.293082 arp reply guadeloupe.sr.epita.fr is-at 0:0:e8:46:1:3e
19:04:48.293920 truncated-ip - 15 bytes missing!garp.1059 >
guadeloupe.sr.epita.fr.domain: 20988+ (41)
19:04:48.295628 truncated-ip - 100 bytes
missing!guadeloupe.sr.epita.fr.domain > garp.1059: 20988* 1/1/1 (126)
19:04:54.073056 truncated-ip - 35 bytes missing!ouranos.epi.net.socks >
garp.1832: P 1006131038:1006131075(37) ack 2947300200 win 17520
<nop,nop,timestamp 341097 3757016>
19:04:54.073627 truncated-ip - 17 bytes missing!garp.1059 >
guadeloupe.sr.epita.fr.domain: 20989+ (43)
19:04:54.075445 truncated-ip - 142 bytes
missing!guadeloupe.sr.epita.fr.domain > garp.1059: 20989 1/2/2 (168)
19:04:54.092439 garp.1832 > ouranos.epi.net.socks: . ack 37 win 31856
<nop,nop,timestamp 3758096 341097> (DF)
19:04:56.432539 truncated-ip - 98 bytes missing!ouranos.epi.net.socks >
garp.1832: P 37:137(100) ack 1 win 17520 <nop,nop,timestamp 341102 3757016>
19:04:56.452436 garp.1832 > ouranos.epi.net.socks: . ack 137 win 31856
<nop,nop,timestamp 3758332 341102> (DF)
Do you you notice all the 'truncated-ip' ??
I know that there is a bug on older version of tcpdump, but this is a
recent version.
So do you think that the kernel have a pb ?? Or It comes from my lib ?
Thanks,
js
-- paris,earth,france
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/