[Ntop-misc] Packet misalignment (4 bytes out)
deri at ntop.org
Tue Dec 11 10:01:30 CET 2007
shame on me. I have modified some datastructures week ago but I have
forgot to update one of them. Please resync: it should work now.
Thanks for reporting the problem, Luca
Matthew Prowse wrote:
> I have emailed Luca describing the problem described below, and
> wondered if anyone else has seen it or can explain it.
> I have compiled the latest PF_RING from svn into kernel-2.6.9-42 (the
> default for CentOS 4.4, iirc) using the rpm instructions at SYNful
> packet. If I compile pcount against libpfring and modify it to output,
> or wireshark against libpcap with a pfring backend, I capture packets
> where the destination MAC address begins at offset 0x0004.
> 0000 22 00 2a 00 *00 18 39 4f 55 e9* 00 15 c5 3b 69 98
> 0010 08 00 45 00 00 3e 99 3a 40 00 40 11 18 5c c0 a8
> 0020 01 64 c2 a8 04 64 80 7b 00 35 00 2a 89 54 5b fa
> The expected MAC addresses start at 0004 and 000a instead of 0000 and
> This happens consistently for every packet.
> Any ideas?
> Ntop-misc mailing list
> Ntop-misc at listgateway.unipi.it
Luca Deri <deri at ntop.org> http://luca.ntop.org/
Don't be encumbered by past history. Go off and do
something wonderful - Robert Noyce
More information about the Ntop-misc