[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Feb 12, 2002 at 10:41:05AM +0100, Marcin Gryszkalis wrote:
> It's oryginal version, looks like it's 0.6
> tcpdump says:
> tcpdump version 3.6.3
> libpcap version 0.6

I.e., it's the version that came with FreeBSD?

If so, the libpcap is pretty much unmodified 0.6.2.

> Do you think I should upgrade to 3.7.1 / 0.7.1 ?

It probably won't help - the BPF support didn't change much between
0.6.2 and 0.7.1 (the biggest change was stuff that's used only on AIX).

There might be a problem in BPF, there might be a problem with libpcap,
or there might be a bug somewhere in Tethereal causing it to overwrite
data in the packet buffer.  Unfortunately, I don't know where the bugs
might be, and won't have time to try to figure it out.

The bug means that not all packets are getting dissected correctly, so
your script won't necessarily find all the HTTP requests on your
network....