Hello! > on older kernels as well. But I think ultimately we should fix the kernel. Well, if you are cycled on "correctness", you could remove truncation. I do not think that someone uses it nowadays. Just delete skb_trim from sk_filter, and that's all. > If the mmap interface was guaranteed to be available that would already=20 > fix it. Sorry? Is packet socket guaranteed to be present? 8)8) What's about 2.2, I am sorry, but time machine is still not invented, so that your "correct" code has to work with not-hacked LPF. Read, "correct" BPF generator uses "ret -1". Actually, referring to compatibility you immediately prove that there are no reasons to change kernel. 8) > differences and the tcpdump.org code is way away from yours. Both implement > a lot of new stuff, sometimes the same stuff in different ways. It's not > easy to merge that.=20 BTW at that point patch was applied almost cleanly, ignoring IPv6 chunks in BPF which had to be removed as whole. > If it was that easy why didn't you just do it? Just because I have some other easy things to do. 8) Until my home tcpdump works (and works sort of better than tcpdump.org's one 8)) I cannot force myself to do something in this direction. It is not antipathy of any kind, it is just plain pragmatism. I need real tcpdump, rather than "correctly" written piece of code yet. 8) > I prefer to have a clean implementation that does not support everything > but does the working stuff "correctly". Wow... First of all it would not be so bad to make it simply working and usable i.e. supporting all that required of tcpdump. Then it will be "correct" in the first approximation at least. 8)8) Do you want one very simple example? That sample of BPF code forces to suspect, that tcpdump uses default snapsize of 68 until now, right? It means that all the bug reports about TCP made with such tcpdump are useless and I will have to requery reports, to teach people how to use -s option etc. Well, "incorrectness" consists exactly of such small inconveniences. Alexey - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.rutgers.edu
