Subject: Re: libpcap - not MI?
To: None <email@example.com>
From: Michael Richardson <firstname.lastname@example.org>
Date: 02/07/2001 13:52:08
>>>>> "der" == der Mouse <mouse@Rodents.Montreal.QC.CA> writes:
der> I had occasion, today, to move a tcpdump packet file (written with
der> tcpdump -w) from NetBSD/alpha to NetBSD/sparc. Trying to read it on
der> the SPARC with tcpdump -r produced a "bogus savefile header" whine.
der> On inspecting the file manually and reading the source to libpcap, I
der> found that there's a "struct timeval" in struct pcap_pkthdr, which
der> occupies twice as much space on /alpha as on /sparc. Since this is
der> written directly to the file, it renders the file nonportable.
I think that Itojun had imported the 0.5.x libpcap from tcpdump.org into
NetBSD 1.5, which does fix this by standardizing on two 32-bit values rather
than a struct timeval. A future rev of libpcap format will likely include
support for 64-bit time. It may be that ethereal's reader can convert your
] Train travel features AC outlets with no take-off restrictions|gigabit is no[
] Michael Richardson, Solidum Systems Oh where, oh where has|problem with[
] email@example.com www.solidum.com the little fishy gone?|PAX.port 1100[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy"); [