On 2014-10-20, Stefan Wollny <stefan.wol...@web.de> wrote: > Hi there! > > I use a Lenovo T60 with amd64-5.6-current / #452 from Oct. 20th. > > Looking at what 'tcpdump -nettti pflog0 inbound and action block' > reports I noticed the following: > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > ~ $ sudo tcpdump -nettti pflog0 inbound and action block > tcpdump: WARNING: snaplen raised from 116 to 160 > tcpdump: listening on pflog0, link-type PFLOG > Oct 20 16:48:38.881272 rule 3/(match) block in on trunk0: \ > 192.168.178.11.24196 > 239.255.0.1.9303: udp 169 > tcpdump: WARNING: compensating for unaligned libpcap packets > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Google came up with an old thread from 2010 that was of no help to me. > > Is this WARNING expected behaviour or s.th. to be taken care of?
Kind-of expected. The comment in tcpdump's source code does actually say "This will never happen with BPF", but it can happen with encapsulated packets.
