Ethereal-users: RE: [Ethereal-users] TCP statistics and capture filter fails for VLAN tagged fr

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Mads Nielsen (DXD)" <Mads.B.Nielsen@xxxxxxxxxxxxxxx>
Date: Mon, 3 Feb 2003 23:14:27 +0100
Thanks - that was a fast and comprehensive answer!!

>The TCP stream analysis code has hardwired into it the notion that IP is
>running directly atop either Ethernet or PPP, with no intervening
>protocols - such as 802.1Q.
>
>It could probably be rewritten to use the new "tap" mechanism, as
>there's now a tap in the TCP dissector; that would make it independent
>of the link layer.
That could really be nice - hopefully that is an exiting job for somebody ;-)


>> Also the capture filter seems no longer to support "vlan" keyword
>> (maybe somewhere in the BPF engine).
>That's an issue of the version of libpcap you're using, not an issue of...

I thought we were using WinPcap2.3 but downloaded it again from
http://winpcap.polito.it/install/default.htm (WinPcap_2_3.exe).
$ ls -l
total 1003
-rwxr-xr-x    1 dxdmap   unknown    692007 Jul 26  2002 WinPcap.exe     # OLD
-rwxr-xr-x    1 dxdmap   unknown    334628 Feb  3 22:45 WinPcap_2_3.exe # NEW

Hmmm - both the packet.dll and the wpcap.dll were different sizes:

#OLD
$ ls -l packet* wpcap*
-rwx------+   1 Administ unknown     32768 Jul 26  2001 packet.dll
-rwxrwxrwx    1 Administ unknown    131072 Jul 26  2001 wpcap.dll

#NEW
$ ls -l packet* wpcap*
-rwx------+   1 Administ unknown     61440 Mar 14  2002 packet.dll
-rwx------+   1 Administ unknown    151552 Mar 14  2002 wpcap.dll

The "vlan" keyword in the capture filter seems to work with the "new v2.3" DLLs.

Anyway we sometimes use our own compilation of packet.dll (compiled with
WPcapSrc_2_3.zip) - to allow us to trace in a remote device....
I made that compilation long time ago - but it looks like an older version
has entered our local FTP server.

/Mads