Bug 43884 - libpcap loses packets
Summary: libpcap loses packets
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: tcpdump
Version: 7.1
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Harald Hoyer
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2001-06-07 18:59 UTC by Tad Marko
Modified: 2008-05-01 15:38 UTC (History)
0 users

Clone Of:
Last Closed: 2001-07-19 16:24:10 UTC

Attachments (Terms of Use)

Description Tad Marko 2001-06-07 18:59:06 UTC
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)

Description of problem:
A network traffic monitoring program that was working starts missing 
packets when compile with libpcap from libpcap-0.4-39.i386.rpm. Installing 
the older libpcap-0.4-19.i386.rpm cures the problem.

How reproducible:

Steps to Reproduce:
1. compile with libpcap-0.4-39


Actual Results:  Sniffer program misses packets.

Expected Results:  Sniffer program should see all packets.

Additional info:

Comment 1 Harald Hoyer 2001-06-18 13:42:31 UTC
which sniffer program?

Comment 2 Tad Marko 2001-06-18 13:58:35 UTC
Sorry, I was in an extreme hurry that day. One I have written. I can supply an 
example that exhibits the problem if necessary. However, the problem is 
difficult to notice unless you already know what the data coming from the NIC 
should look like. It is entire packets that are missing.

Comment 3 Harald Hoyer 2001-07-19 13:05:02 UTC
you may try libpcap-0.6.2 from rawhide

Comment 4 Tad Marko 2001-07-19 16:24:06 UTC
At this point, I think the problem may have been my bug, but there was a change 
in libpcap that caused the problem to appear. My buffer size for the 
pcap_open_live call was borderline too small. This did not affect earlier 
versions of libpcap. They simply passed the packets anyway. I'm not sure how 
that worked, but it didn't crash. Apparently, though I have not checked the 
libpcap code, the new version only passes the packet on if it will fit into the 
allocated buffer. I have only just now discovered this, so I am still testing, 
but it appears that all is working correctly now.


Note You need to log in before you can comment on or make changes to this bug.