[Ntop-misc] Packet misalignment (4 bytes out)

[Luca Deri]

Matthew
shame on me. I have modified some datastructures week ago but I have
forgot to update one of them. Please resync: it should work now.

Thanks for reporting the problem, Luca

Matthew Prowse wrote:
> Hi,
>
> I have emailed Luca describing the problem described below, and
> wondered if anyone else has seen it or can explain it.
>
> I have compiled the latest PF_RING from svn into kernel-2.6.9-42 (the
> default for CentOS 4.4, iirc) using the rpm instructions at SYNful
> packet. If I compile pcount against libpfring and modify it to output,
> or wireshark against libpcap with a pfring backend, I capture packets
> where the destination MAC address begins at offset 0x0004.
>
> 0000  22 00 2a 00 *00 18 39 4f  55 e9* 00 15 c5 3b 69 98
> 0010  08 00 45 00 00 3e 99 3a  40 00 40 11 18 5c c0 a8
> 0020  01 64 c2 a8 04 64 80 7b  00 35 00 2a 89 54 5b fa
>
> The expected MAC addresses start at 0004 and 000a instead of 0000 and
> 0006.
>
> This happens consistently for every packet.
>
> Any ideas?
>
> Matt
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc at listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc


-- 
Luca Deri <deri at ntop.org>	http://luca.ntop.org/
                                skype://lucaderi/
Don't be encumbered by past history. Go off and do
something wonderful - Robert Noyce