Red Hat Bugzilla – Bug 43884
libpcap loses packets
Last modified: 2008-05-01 11:38:00 EDT
From Bugzilla Helper: User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Description of problem: A network traffic monitoring program that was working starts missing packets when compile with libpcap from libpcap-0.4-39.i386.rpm. Installing the older libpcap-0.4-19.i386.rpm cures the problem. How reproducible: Always Steps to Reproduce: 1. compile with libpcap-0.4-39 Actual Results: Sniffer program misses packets. Expected Results: Sniffer program should see all packets. Additional info:
which sniffer program?
Sorry, I was in an extreme hurry that day. One I have written. I can supply an example that exhibits the problem if necessary. However, the problem is difficult to notice unless you already know what the data coming from the NIC should look like. It is entire packets that are missing.
you may try libpcap-0.6.2 from rawhide
At this point, I think the problem may have been my bug, but there was a change in libpcap that caused the problem to appear. My buffer size for the pcap_open_live call was borderline too small. This did not affect earlier versions of libpcap. They simply passed the packets anyway. I'm not sure how that worked, but it didn't crash. Apparently, though I have not checked the libpcap code, the new version only passes the packet on if it will fit into the allocated buffer. I have only just now discovered this, so I am still testing, but it appears that all is working correctly now. Thanks!