tcpdump Mailing List

Covers the classic tcpdump text-based network sniffer and its libpcap sniffer library component.

List Archives

Latest Posts

Error in the pcap_next_ex(3PCAP) man page Aaron Rainbolt (Mar 24)
Hi,

In the "Return Value" section of the pcap_next_ex(3PCAP) manpage, it
says that "pcap_next_ex() returns... PCAP_ERROR_BREAK if packets are
being read from a ``savefile'' and there are no more packets to read
from the savefile...". This is incorrect; the source code states that
PCAP_ERROR_BREAK can be returned if the pcap_next_ex() call is
interrupted by pcap_breakloop():

#define PCAP_ERROR_BREAK...

Re: POSIX and float rounding Guy Harris (Mar 19)
It could solve it reliably *if* you choose a rounding mode *other* than round-to-nearest; I don't think the other modes
have the problem of "which of 0 and 1 is nearest to .5?"

Unfortunately, fesetround(), prior to C23, doesn't offer a way to tell the floating-point environment how to break the
tie, as it offers no choice between different flavors of round-to-nearest. C23 distinguishes between FE_TONEAREST,
which is...

Re: POSIX and float rounding Denis Ovsienko (Mar 19)
Thank you for the detailed analysis. Are you saying that fesetround()
cannot solve this problem reliably?

The simplest workaround would be to fork the test into one QNX-only
version and another except-QNX version (assuming QNX does not change its
rounding method).

Re: POSIX and float rounding Rick Jones via tcpdump-workers (Mar 19)

Re: POSIX and float rounding Guy Harris (Mar 19)
In any case, given all this mishegoss, the right answer is probably to have the script see how the floating-point value
0.5 is printed with %.0f, and choose which test to perform based on that, in the hopes that whatever rounding the
scripting program does matches what tcpdump will do.

Re: POSIX and float rounding Guy Harris (Mar 19)
As for a rationale for QNX's behavior, for what it's worth, Google's Artificial Brain says:

Key Details regarding QNX roundTiesToAway Behavior:

• Behavior: For a number like 0.5, round(0.5) returns 1.0, and round(-0.5) returns −1.0.

• Library: Part of libm (general-purpose math library) and libm-sve (optimized for ARMv8).

• Context: Unlike some IEEE 754 default behaviors that...

Re: POSIX and float rounding Guy Harris (Mar 19)
https://www.qnx.com/developers/docs/6.5.0SP1.update/com.qnx.doc.neutrino_prog/posix_conformance.html

says

For the fprintf() function, the low-order digit rounding for numbers in double format is round-to-nearest.

and appears to be completely silent on which IEEE 754 "what about ties?" flavor it implements.

Re: POSIX and float rounding Guy Harris (Mar 19)
The Wikipedia says:

https://en.wikipedia.org/wiki/IEEE_754#Rounding_rules

Tl;dr: there are *five* rounding rules:

• Round to nearest, ties to even – rounds to the nearest value; if the number falls midway, it is rounded to the
nearest value with an even least significant digit.
• Round to nearest, ties away from zero (or ties to away) – rounds to the nearest value; if the number falls
midway, it is rounded to the...

Re: POSIX and float rounding Guy Harris (Mar 19)
So that's true on *all* of the platforms, including QNX?

That's annoying. It appears that QNX's definition of "to nearest", in the "the two choices are equidistant" case, is
different from that of all other platforms (and from what I guess I was taught in school, as I've always thought you
were supposed to round 0.5 up to 1).

Perhaps it's time to see what IEEE 754 has to say on the topic.

Re: POSIX and float rounding Denis Ovsienko (Mar 19)
$ ./roundingmode
Rounding mode: to nearest

fenv.h defines exactly the four FE_ rounding modes.

Re: POSIX and float rounding Guy Harris (Mar 19)
As for POSIX, it says "The functionality described on this reference page is aligned with the ISO C standard. Any
conflict between the requirements described here and the ISO C standard is unintentional. This volume of IEEE Std
1003.1-2001 defers to the ISO C standard." in a number of places, including <fenv.h>, fegetround(), fesetround(), and
fprintf().

Re: POSIX and float rounding Guy Harris (Mar 19)
The first question to ask is "does *the C standard* define which method printf() is supposed to use for rounding a
float?"

C99 says, in 7.19.6.1 "The fprintf function":

f,F A double argument representing a floating-point number is converted to decimal notation in the style
[−]ddd.ddd, where the number of digits after the decimal-point character is equal to the precision specification. If
the precision is...

POSIX and float rounding Denis Ovsienko (Mar 19)
Hello all.

QNX SDP 8.0.3 QSTI build 245 (2026-03-09) includes Perl (again!), so I
ran tcpdump tests on it and one test failed:

Failed tests:
olsr-oobr-1 : diff exited with 1
- vtime 0.062s, msg-seq 0x0008, length 127 [|olsr]
+ vtime 0.063s, msg-seq 0x0008, length 127 [|olsr]
- vtime 0.062s, msg-seq 0x0008, length 100 [|olsr]
+ vtime 0.063s, msg-seq 0x0008, length 100 [|olsr]
-...

Re: Accurate ECN support in tcpdump/libpcap Francois via tcpdump-workers (Mar 06)

Re: Accurate ECN support in tcpdump/libpcap Denis Ovsienko (Mar 05)
alternatives, but not better than "set" and "cleared".

Considering the user-visible part of the solution, it is desirable to
introduce filter expressions that are as difficult to misunderstand as
possible. As far as it makes sense to me, "cleared" is the proper term
in bitwise arithmetics and it obviously means "set to 0", whereas
"unset" could be understood as "never set" or...

More Lists

Dozens of other network security lists are archived at SecLists.Org.