What svn revision are you using? I saw similar problems in my own code using the libpcap supplied with pf-ring, which did not have the patch of revision 4498 applied.
Jasper On 08/03/11 09:45, M. V. wrote: > in order to boost capturing performance, i installed PF-Ring for > libpcap on Debian-6.0 using the link below. i got latest version of > pf-ring from svn, and recompiled my intel-card's driver to support > pf_ring. i didn't get any error or problem during the process. > > http://www.ntop.org/blog/?p=125 > > now, when i use tcpdump which is compiled with libpcap-pf_ring to > capture traffic, it captures with no error or warning and it seems > that my capturing performance got better (based on capture-file size), > but the problem is: > > when i open captured file with wireshark or tcpdump itself, i got a > weird error about bad packets size. > > wireshark error: > ---------------------- > The capture file appears to be damaged or corrupt. > (pcap: File has 3014350264-byte packet, bigger than maximum of 65535) > > tcpdump error: > -------------------- > tcpdump: pcap_loop: bogus savefile header > > i don't know what is the problem, so i wanted to ask if anyone has > experienced this before or has any idea about it. -- Ir. Jasper Spaans Fox-IT Experts in IT Security! T: +31 (0) 15 284 79 99 KvK Haaglanden 27301624
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
