Curt Sampson <cjs@cynic.net> writes:

> On 27 Jun 1999, Christian E. Hopps wrote:
> 
> > Yes, but tcpdump is also used for many things besides that and its
> > pretty annoying to have these bad frames interleaved between valid
> > ones.
> 
> But isn't tcpdump typically used with a filter spec (`host foo',
> `ether host foo', `port smtp', etc.)? Do these runts come through
> even with sucha filter spec?

Typically when the filter is around yes.  However, there are plenty of
times when you don't have a filter.  These times in paticular are when
this `feature' is annoying.  In my case the filter was

        not ip and not arp

So that I could look at isis traffic (which even though tcpdump will
parse some of the iso stuff it doesn't support much of it or any filters 
as far as I could tell).

Whats wrong with using the normal bad packet counters to determine if
your network is losing?  Lets not make it seem like this is the only or
even correct tool for diagnosing network problems (it may be useful on
occasion).  I suggested an if link flag if you really want to look
at bad data, otherwise I think it should be filtered at the hardware
level.

Chris.