[Guy Harris <guy@xxxxxxxxxx>]

> This problem seems new to me.  Does this have to do with libpcap-0.6.2 (as
> opposed to 0.5),

Possibly, as 0.6.2 uses the new PF_PACKET socket mechanism and, if
present, the Linux kernel socket filter mechanism.

> or the linux kernel (2.4.1 instead of 2.2.16)?

Possibly, although from brief looks at the packet-socket code, the
biggest change is the addition of memory mapping support, which 0.6.2
doesn't use.  (We'll probably add support at some point.)

Does your kernel have the socket filter option enabled?

I'd try it with:

	libpcap 0.5[.x]/tcpdump 3.5[.x];

	libpcap 0.6[.x]/tcpdump 3.6[.x];

to see if they both show the behavior or not.