Re: Aha! I was right

From: Ethan Blanton (
Date: 12/21/00

Date: Thu, 21 Dec 2000 17:16:03 -0500
From: Ethan Blanton <>
Subject: Re: Aha! I was right
Message-ID: <>

Wesley Eddy spake unto us the following wisdom:
> I checked up some more on this by looking at an actual Redhat box of a friend
> of mine, and I was right, the pcap.h they ship has ts as a bpf_timeval instead
> of a plain old timeval. I'm not sure if you can just do a cast in the tcptrace
> code to fix it, but in any case, getting a different libpcap should fix it.

That's not the only brain damage the RH7 pcap seems to have,
unfortunately... So far as I can tell it also uses a different magic
number. I have no earthly idea why... At any rate, I have had no luck
reading a RH7-captured dump on a Solaris box.

*Notice*:  My GPG key has changed.  Please retrieve the new key via:
            gpg --keyserver --recv-key 883C1C14
           Sorry for the inconvenience.  Please note that the new key
	   is signed with my old key for preliminary verification.

This archive was generated by hypermail 2b30 : 01/09/01 EST