Re: [tcpdump-workers] how to detect a bridged pseudo mac-addr.

Hi, On Fri, Mar 25, 2005 at 02:07:49AM +0100, Per Engelbrecht wrote: > So fare I've done all my "tapping" on the backbone's SPAN port. > I do have SPAN ports on all the customer switches as well, but don't use > them right now - I'm building an NDIS master with sensors (hardware > clients) going

Re: [tcpdump-workers] QUEUE target!!

Hi to all, Does anyone have an example of how to work with the QUEUE target for ebtables. If you have, please do send it to me so that I can try to understand how to work with it. Thx in advance.. Regards, Visham This mail has been scanned for viruses by the UoM Antivirus Gateway. - This is

Re: [tcpdump-workers] how to detect a bridged pseudo mac-addr.

Gert Doering wrote: Hi, On Fri, Mar 25, 2005 at 02:07:49AM +0100, Per Engelbrecht wrote: So fare I've done all my "tapping" on the backbone's SPAN port. I do have SPAN ports on all the customer switches as well, but don't use them right now - I'm building an NDIS master with sensors (hardware cli

[tcpdump-workers] BPF buffer size considerations

Hi, i am trying to minimize the dropped packet count, which maybe due to a too small buffer in the BPF driver. are there any bad implications of setting the BPF buffer size to 1meg and hardcoding pcap-bpf.c to use the buffer size of 1meg? [wasting kernel memory does not count.] thanks! -alexm 1

Re: [tcpdump-workers] BPF buffer size considerations

alexander medvedev wrote: i am trying to minimize the dropped packet count, which maybe due to a too small buffer in the BPF driver. are there any bad implications of setting the BPF buffer size to 1meg and hardcoding pcap-bpf.c to use the buffer size of 1meg? [wasting kernel memory does not count.