Guy Harris

[Patch] support saving and loading of pre-compiled BPF programs

3

Converted from [SourceForge issue 1217087](http://sourceforge.net/support/tracker.php?aid=1217087), submitted by maneo have generated a patch which adds two functions to the libpcap API: ``` pcap_loadfilter ``` () ``` pcap_savefilter ``` () In a...

pcap-filter man, better libpcap filter expressions intro

4

Converted from [SourceForge issue 2823520](http://sourceforge.net/support/tracker.php?aid=2823520), submitted by doru001 For clarity and ease of learning reasons, please change the filter expressions presentation paragraphs to include: - rename all qualifiers as modifiers,...

ineffective filter optimization

3

Converted from [SourceForge issue 1889037](http://sourceforge.net/support/tracker.php?aid=1889037), submitted by amotin Using libpcap 0.9.8 I have found that it in some cases generates very ineffective code For example: ``` %tcpdump -i lo0 -d...

OR'ing vlans impossible in tcpdump filter

12

Converted from [SourceForge issue 3469486](http://sourceforge.net/support/tracker.php?aid=3469486), submitted by spp2 There is a small bug I have seen while trying to filter on several VLANs; I'm unable to specify more than one...

Display/filter on packet direction and interface name

26

Converted from [SourceForge issue 2850109](http://sourceforge.net/support/tracker.php?aid=2850109), submitted by leonerd When capturing from a single interface, libpcap only allows the EN10MB link type, which contains only the ethernet frame, with no context...

stack overflow

5

Converted from [SourceForge issue 709338](http://sourceforge.net/support/tracker.php?aid=709338), submitted by nobody ``` static int count_blocks(p) struct block *p; { if (p == 0 || isMarked(p)) return 0; Mark(p); return count_blocks(JT(p)) + count_blocks(JF(p)) +...

Filter optimizing HANGS in infinite loop

7

Converted from [SourceForge issue 1969699](http://sourceforge.net/support/tracker.php?aid=1969699), submitted by nulldef well, trying to compile the following filter with optimization enabled gets to an infinite loop, and hangs the process on 100% cpu...

strncpys in libpcap should be strlcp

6

Converted from [SourceForge issue 599847](http://sourceforge.net/support/tracker.php?aid=599847), submitted by donhatch All strncpys in libpcap should be changed to strlcpy. Also, there is this strange thing in pcap-snit.c: strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); ifr.ifr_name[sizeof(ifr.ifr_name) -...

Should the stdio buffer size be increased for the dump code?

12

[A blog post from Napatech](https://www.napatech.com/dpdk-packet-capture-pdump/) says: > The most obvious bottleneck was in the pcap_dump() function within libpcap and actually the problem should be fixed within libpcap if you ask...

Reading from stdin while dumping to file causes crash

10

Converted from [SourceForge issue 3602279](http://sourceforge.net/support/tracker.php?aid=3602279), submitted by toreanderson When attempting to reading from stdin and dumping the result to a capture file, the process crashes almost instantly. An easy way...