Your message dated Mon, 10 Oct 2005 20:05:57 +0200
with message-id <[EMAIL PROTECTED]>
and subject line Closing
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 15 Mar 2005 17:03:44 +0000
>From [EMAIL PROTECTED] Tue Mar 15 09:03:44 2005
Return-path: <[EMAIL PROTECTED]>
Received: from mail.dollargeneral.com (dollargeneral.com) [208.23.227.7]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DBFSK-0007Ts-00; Tue, 15 Mar 2005 09:03:44 -0800
Received: from ([172.20.2.133])
by mail.dollargeneral.com with ESMTP id 133030116.19854843;
Tue, 15 Mar 2005 11:02:39 -0600
Received: by ex01.dolgen.net with Internet Mail Service (5.5.2653.19)
id <G0HFRT3F>; Tue, 15 Mar 2005 11:02:39 -0600
Message-ID: <[EMAIL PROTECTED]>
From: Tyler West <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: filter expressions not working in tcpdump and tethereal
Date: Tue, 15 Mar 2005 11:02:29 -0600
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C52980.C5251382"
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-2.4 required=4.0 tests=HAS_PACKAGE,HTML_50_60,
HTML_MESSAGE autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------_=_NextPart_001_01C52980.C5251382
Content-Type: text/plain
Package: libpcap0.8
Version: 0.8.3-5
Something seems to be broken with libpcap under Debian Sarge. When
capturing traffic on a particular host, if I execute my tcpdump or tethereal
without a filter expression, I can see traffic captured for host a.b.c.d.
However if I add the filter expression 'host a.b.c.d' to the end of my
tcpdump or tethereal command it doesn't appear to capture any packets. In
doing some basic research I saw where a similar bug had occurred a couple of
years ago but I am not a programmer and simply had to stop at a point in the
research when it got over my head. This problem also appears to affect
other filter expressions as well. Without a filter expression I can see
obvious HTTP traffic but if I append 'port 80' it won't capture anything.
I am running Debian Sarge with kernel 2.6.8-1 (default install, non-custom).
I'm assuming the problem is with libpcap since it affects both tcpdump and
tethereal. I have multiple Broadcom BCM5782 NICs using the tg3 driver. My
shared C library is libc-2.3.2.so.
Thanks,
Tyler West, CCNA
Senior Network Engineer
Dollar General Corporation
------_=_NextPart_001_01C52980.C5251382
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40";>
<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3DEN-US link=3Dblue vlink=3Dpurple>
<div class=3DSection1>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Package: libpcap0.8<o:p></o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Version: 0.8.3-5<o:p></o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Something seems to be broken with libpcap under =
Debian
Sarge. When capturing traffic on a particular host, if I execute =
my
tcpdump or tethereal without a filter expression, I can see traffic =
captured
for host a.b.c.d. However if I add the filter expression =
‘host
a.b.c.d’ to the end of my tcpdump or tethereal command it =
doesn’t
appear to capture any packets. In doing some basic research I saw =
where a
similar bug had occurred a couple of years ago but I am not a =
programmer and
simply had to stop at a point in the research when it got over my =
head.
This problem also appears to affect other filter expressions as =
well.
Without a filter expression I can see obvious HTTP traffic but if I =
append ‘port
80’ it won’t capture anything.<o:p></o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>I am running Debian Sarge with kernel 2.6.8-1 =
(default
install, non-custom). I’m assuming the problem is with =
libpcap
since it affects both tcpdump and tethereal. I have multiple =
Broadcom BCM5782
NICs using the tg3 driver. My shared C library is =
libc-2.3.2.so.<o:p></o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Thanks,<o:p></o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Tyler West, CCNA</span></font><o:p></o:p></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Senior Network Engineer</span></font><o:p></o:p></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Dollar General =
Corporation</span></font><o:p></o:p></p>
<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>
------_=_NextPart_001_01C52980.C5251382--
---------------------------------------
Received: (at 299642-done) by bugs.debian.org; 10 Oct 2005 18:05:42 +0000
>From [EMAIL PROTECTED] Mon Oct 10 11:05:42 2005
Return-path: <[EMAIL PROTECTED]>
Received: from yeast.orebokech.com [82.67.41.165] (romain)
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1EP21t-0000oS-00; Mon, 10 Oct 2005 11:05:42 -0700
Received: from pacem.orebokech.com (pacem.orebokech.com [192.168.1.3])
by yeast.orebokech.com (Postfix) with ESMTP id 91F9712CF9
for <[EMAIL PROTECTED]>; Mon, 10 Oct 2005 20:05:40 +0200 (CEST)
Received: by pacem.orebokech.com (Postfix, from userid 1000)
id A7ED2523ED; Mon, 10 Oct 2005 20:05:57 +0200 (CEST)
From: Romain Francoise <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Closing
Organization: The Debian Project
Date: Mon, 10 Oct 2005 20:05:57 +0200
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-2.0 required=4.0 tests=BAYES_00,ONEWORD autolearn=no
version=2.60-bugs.debian.org_2005_01_02
I believe this bug can now be closed.
--
,''`.
: :' : Romain Francoise <[EMAIL PROTECTED]>
`. `' http://people.debian.org/~rfrancoise/
`-
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
