On 2007/05/28 09:30, Jurjen Oskam wrote: > What can I do to (help) find the cause of this?
oh, another thought... there's probably a missing truncation check which is noticed with encap packets since they have a longer header. try running two copies of tcpdump, one with -s1500 and one without, if the -s1500 one stays running when the other fails, the first packet seen in the -s1500 after the failure should show you what packet data is causing the problem.
