Red Hat Bugzilla – Bug 43884
libpcap loses packets
Last modified: 2008-05-01 11:38:00 EDT
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Description of problem:
A network traffic monitoring program that was working starts missing
packets when compile with libpcap from libpcap-0.4-39.i386.rpm. Installing
the older libpcap-0.4-19.i386.rpm cures the problem.
Steps to Reproduce:
1. compile with libpcap-0.4-39
Actual Results: Sniffer program misses packets.
Expected Results: Sniffer program should see all packets.
which sniffer program?
Sorry, I was in an extreme hurry that day. One I have written. I can supply an
example that exhibits the problem if necessary. However, the problem is
difficult to notice unless you already know what the data coming from the NIC
should look like. It is entire packets that are missing.
you may try libpcap-0.6.2 from rawhide
At this point, I think the problem may have been my bug, but there was a change
in libpcap that caused the problem to appear. My buffer size for the
pcap_open_live call was borderline too small. This did not affect earlier
versions of libpcap. They simply passed the packets anyway. I'm not sure how
that worked, but it didn't crash. Apparently, though I have not checked the
libpcap code, the new version only passes the packet on if it will fit into the
allocated buffer. I have only just now discovered this, so I am still testing,
but it appears that all is working correctly now.