Bug 43884

Summary: libpcap loses packets
Product: [Retired] Red Hat Linux Reporter: Tad Marko <tad>
Component: tcpdumpAssignee: Harald Hoyer <harald>
Status: CLOSED RAWHIDE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 7.1   
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2001-07-19 16:24:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Tad Marko 2001-06-07 18:59:06 UTC 
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)

Description of problem:
A network traffic monitoring program that was working starts missing 
packets when compile with libpcap from libpcap-0.4-39.i386.rpm. Installing 
the older libpcap-0.4-19.i386.rpm cures the problem.

How reproducible:
Always

Steps to Reproduce:
1. compile with libpcap-0.4-39

	

Actual Results:  Sniffer program misses packets.

Expected Results:  Sniffer program should see all packets.

Additional info:
Comment 1 Harald Hoyer 2001-06-18 13:42:31 UTC 
which sniffer program?
Comment 2 Tad Marko 2001-06-18 13:58:35 UTC 
Sorry, I was in an extreme hurry that day. One I have written. I can supply an 
example that exhibits the problem if necessary. However, the problem is 
difficult to notice unless you already know what the data coming from the NIC 
should look like. It is entire packets that are missing.
Comment 3 Harald Hoyer 2001-07-19 13:05:02 UTC 
you may try libpcap-0.6.2 from rawhide
Comment 4 Tad Marko 2001-07-19 16:24:06 UTC 
At this point, I think the problem may have been my bug, but there was a change 
in libpcap that caused the problem to appear. My buffer size for the 
pcap_open_live call was borderline too small. This did not affect earlier 
versions of libpcap. They simply passed the packets anyway. I'm not sure how 
that worked, but it didn't crash. Apparently, though I have not checked the 
libpcap code, the new version only passes the packet on if it will fit into the 
allocated buffer. I have only just now discovered this, so I am still testing, 
but it appears that all is working correctly now.

Thanks!