Hi all. It looks like there is a bug in handling a snaplen of 1500 on linux (with mmap on). If I set a snaplen of 1500 and receive packets > 1500 (e.g. 1514), libpcap returns only 1498 as caplen, and not 1500.
Libpcap latest on git (1.3.0-PRE-GIT_2012_01_15) Linux RHEL6, kernel 2.6.32-131.21.1.el6.x86_64 I tested with tcpdump but I see the same issue with a custom pcap-based tool. Any ideas? Have a nice day GV - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
