On 06/01/2015 04:23 PM, Vadim Kochan wrote: ...
I checked that in this case Ethernet & Netlink frames will be mixed in the pcap file, but netsniff-ng tries to identify all the frames as Ethernet, and in this case frames is not wrapped with cooked header.
Right, so for that use case, it wouldn't work currently. I'm thinking that in case of 'any' device *and* if there's at least one device present at the time we bind the socket to any that would have netlink type, then we would need to turn on cooked mode generally, so that in such environments Ethernet and Netlink would have both cooked headers. I think that would be useful to adapt the patch towards covering such use cases as well since people might also like to correlate i.e. Netlink events together with network packets. Could you please respin the patch towards supporting this, too? Then I think, it should be ready to go in. Thanks, Daniel -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
