Re: Sniffing ranges of ips

[Guy Harris <guy () alum mit edu>]

Alexander Dupuy wrote:

> Note also that there is a bug in the libpcap BPF optimizer (as of 0.8.3) 
> that breaks the hack described above,

Try it with the top-of-tree CVS version; I've made some optimizer fixes 
that will, I think, fix this.

> However, the libpcap 0.7 optimizer not only generates correct BPF, but 
> it is shorter than any of the above, entirely eliminating the use of the 
> index register:
> (000) ldh      [12]
> (001) jeq      #0x800           jt 2    jf 6
> (002) ld       [26]
> (003) jge      #0x1020304       jt 4    jf 6
> (004) jgt      #0x1020506       jt 6    jf 5
> (005) ret      #96
> (006) ret      #0

I'm not sure whether that's a case of the code generator not generating 
code that uses the X register there, or a missing optimization - I have 
a change that should put that optimization back.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.