[tcpdump-workers] How to find the exact error happened when the pcap_loop returns -1

2009-04-01 Thread Shameem Ahamed
Hi All, I am calling the pcap_loop function with a count of -1 (I want to process all the packets in the captured pcap file.). After the first correct packet (packet with a valid payload), pcap_loop terminates with a -1, which indicates an internal error . Am i correct ?. How can i know th

Re: [tcpdump-workers] my problem to install tcpdump

2009-04-01 Thread Sam Roberts
On Wed, Apr 1, 2009 at 10:09 AM, Ahmad Vakili wrote: > Dear Sir/Madam > > I wanted to install tcpdump in my Debian (as a virtual machine on my mac). sudo apt-get install tcpdump - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

[tcpdump-workers] USB packet printer

2009-04-01 Thread Bert Vermeulen
Hi, I've attached a patch that adds a basic USB packet printer for the Linux usbmon capture facility. Up until now, only writing to a file was supported. Also, if you tried to show a live USB capture, the error message indicated that the data link type requested was not supported, when in fact on

[tcpdump-workers] my problem to install tcpdump

2009-04-01 Thread Ahmad Vakili
Dear Sir/Madam I wanted to install tcpdump in my Debian (as a virtual machine on my mac). After ./configure, when I started to MAKE, this message was appeared: "undefined reference to 'pcap_parse'" I am beginner with linux and virtual machine. Would you please help me to solve this problem?

Re: [tcpdump-workers] IP Header Size is always 5

2009-04-01 Thread Shameem Ahamed
Hi All, Thanks for all the replies, and suggestions. I got it resolved. The problem was with a character pointer,i defined earlier. I forgot the fact that header size is in terms of words. Thanks fore reminding me. Regards, Shameem > From: g...@alum.mit.edu > Subject: Re: [tcpdump-w

Re: [tcpdump-workers] IP Header Size is always 5

2009-04-01 Thread Guy Harris
On Apr 1, 2009, at 8:32 AM, Shameem Ahamed wrote: In that case also, we should be able to get the source and destination IP address from the below code printf("Source IP: %s \n",inet_ntoa(ipHeader->ip_src)); For me it gives me Segmentation Fault. inet_ntoa() takes a "struct in_addr" as an

Re: [tcpdump-workers] patch to allow tcpslice to work with zero and one packet captures

2009-04-01 Thread Sam Roberts
On Wed, Mar 25, 2009 at 5:59 PM, Sam Roberts wrote: > tcpslice fails on packet captures with zero or one packet in them. Given > an arbitrary set of captures, it is entirely possible that some of them > don't have packets or have small numbers of packets. Anything else I need to push this patch u

Re: [tcpdump-workers] IP Header Size is always 5

2009-04-01 Thread Florian Weimer
* Shameem Ahamed: > ipHeader=(struct ip*)(packet+ETHER_SIZE); You should declare ipHeader on the stack, and memcpy into it from the packet buffer. You're likely running into an alignment issue. Dealing with IP options will require some extra care. - This is the tcpdump-workers list. Visit https:

Re: [tcpdump-workers] Segmentatio Fault while retrieving source and

2009-04-01 Thread Aaron Turner
Use a debugger like gdb. On Wed, Apr 1, 2009 at 9:32 AM, Shameem Ahamed wrote: > > Hi All, > > > I am getting segmentation fault error, while retrieving the source and destn > ip from ip headers. > > > Code snippet is given below. > > packet is the last argument to the Callback function used in

[tcpdump-workers] Segmentatio Fault while retrieving source and destination IP from Ip header

2009-04-01 Thread Shameem Ahamed
Hi All, I am getting segmentation fault error, while retrieving the source and destn ip from ip headers. Code snippet is given below. packet is the last argument to the Callback function used in pcap_loop === struct ip *ipHeader;//IP Header ethH

Re: [tcpdump-workers] tcp packet capturing

2009-04-01 Thread Shameem Ahamed
Hello Chandrapal, You can apply filters. If you want just tcp packets, first set the filter expression to tcp, then compile the filter and lastly set the filter. See the functions pcap_compile and pcap_setfilter Shameem > Date: Wed, 1 Apr 2009 15:00:52 +0530 > Subject: [tcpdump-worke

Re: [tcpdump-workers] tcp packet capturing

2009-04-01 Thread Aaron Turner
No code changes. Just use a bpf filter (documented in the man page). On Wed, Apr 1, 2009 at 2:30 AM, chandrapal chahar wrote: > Hi, > > I want to know how to capture only TCP(discard other packets) packets > flowing in the network. What modifications will I have to do in the coding > part ? --

[tcpdump-workers] tcp packet capturing

2009-04-01 Thread chandrapal chahar
Hi, I want to know how to capture only TCP(discard other packets) packets flowing in the network. What modifications will I have to do in the coding part ? please reply as soon as possible Thanking you Chandrapal Chahar - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to uns

Re: [tcpdump-workers] IP Header Size is always 5

2009-04-01 Thread Shameem Ahamed
Hello Sebastian, Thanks for the reply. In that case also, we should be able to get the source and destination IP address from the below code printf("Source IP: %s \n",inet_ntoa(ipHeader->ip_src)); For me it gives me Segmentation Fault. Also, i am not able to access the tcp header details.

Re: [tcpdump-workers] IP Header Size is always 5

2009-04-01 Thread Sebastien Roy
On Wed, 2009-04-01 at 20:42 +0530, Shameem Ahamed wrote: > I was trying to create a function (for testing purpose) which displays > the header information for Ethernet, IP and TCP using a Linux machine. > The problem i am having is, whenever i read any packet from the saved > pcap file, it displays

[tcpdump-workers] IP Header Size is always 5

2009-04-01 Thread Shameem Ahamed
Hi All, I was trying to create a function (for testing purpose) which displays the header information for Ethernet, IP and TCP using a Linux machine. The problem i am having is, whenever i read any packet from the saved pcap file, it displays the IP header size (ip->ip_hl) is 5 (some times les

Re: [tcpdump-workers] Privileges on Mac

2009-04-01 Thread Tobias Weber
On 01.04.2009, at 00:47, Guy Harris wrote: If you're talking about Authorization Services, they suggest using set-UID programs (that changed years ago, but no one uses the new way) A set-UID program that does what privileged stuff it needs to do (opening a pcap_t, (what I've seen is usin