Re: libpcap on Mac Os X 10.6 Snow Leopard

[Marco De Angelis <thorar () yahoo com>]

Guy Harris <guy <at> alum.mit.edu> writes:

> > some printout I could add before calling pcap_dispatch to see what's in the
> > kernel buffer and what in the userland buffer?
>
> Yes, but you'd have to add it to libpcap. 
>
> > > Is your program built as a 32-bit program or a 64-bit program?

To summarize, the "lipo -info lipo -i /usr/sbin/tcpdump" command reports as
expected:

   Architectures in the fat file: /usr/sbin/tcpdump are: x86_64 i386 

Executed on tcpdump recompiled by me on the same machine using makefile:

   Non-fat file: tcpdump is architecture: x86_64

I recompiled the test application "inspector" (which uses lipcap to capture) for
architecture i386, and no packets were delivered by libpcap. I recompiled for
x86_64, now I get:

   Non-fat file: inspector is architecture: x86_64

But the problem is still the same. 

I am compiling with Xcode 3.2.1, gcc version is 4.2.1. The project is generated
by cmake, and the build default arhitecture is i386. I also tried generating the
Makefile with cmake and use to compile the application, but without benefit. 

I also tried changing snaplen wih high and low values, timeout values greater
than 1000, promisc mode on/off, etc. None of these changes seem to modify the
behaviour except the aforementioned pcap_set_buffer_size(128).


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.