Bug 43884 - libpcap loses packets
libpcap loses packets
Product: Red Hat Linux
Classification: Retired
Component: tcpdump (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Harald Hoyer
Depends On:
  Show dependency treegraph
Reported: 2001-06-07 14:59 EDT by Tad Marko
Modified: 2008-05-01 11:38 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2001-07-19 12:24:10 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Tad Marko 2001-06-07 14:59:06 EDT
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)

Description of problem:
A network traffic monitoring program that was working starts missing 
packets when compile with libpcap from libpcap-0.4-39.i386.rpm. Installing 
the older libpcap-0.4-19.i386.rpm cures the problem.

How reproducible:

Steps to Reproduce:
1. compile with libpcap-0.4-39


Actual Results:  Sniffer program misses packets.

Expected Results:  Sniffer program should see all packets.

Additional info:
Comment 1 Harald Hoyer 2001-06-18 09:42:31 EDT
which sniffer program?
Comment 2 Tad Marko 2001-06-18 09:58:35 EDT
Sorry, I was in an extreme hurry that day. One I have written. I can supply an 
example that exhibits the problem if necessary. However, the problem is 
difficult to notice unless you already know what the data coming from the NIC 
should look like. It is entire packets that are missing.
Comment 3 Harald Hoyer 2001-07-19 09:05:02 EDT
you may try libpcap-0.6.2 from rawhide
Comment 4 Tad Marko 2001-07-19 12:24:06 EDT
At this point, I think the problem may have been my bug, but there was a change 
in libpcap that caused the problem to appear. My buffer size for the 
pcap_open_live call was borderline too small. This did not affect earlier 
versions of libpcap. They simply passed the packets anyway. I'm not sure how 
that worked, but it didn't crash. Apparently, though I have not checked the 
libpcap code, the new version only passes the packet on if it will fit into the 
allocated buffer. I have only just now discovered this, so I am still testing, 
but it appears that all is working correctly now.


Note You need to log in before you can comment on or make changes to this bug.