DAG: Refine the low snaplen filtering bug fix.

Add a comment to explain the three lengths involved in the packet
filtering, fixup the change log entry.

CHANGES

@@ -84,7 +84,7 @@ DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
       If the environment variable ERF_FCS_BITS is set, require it to be either
         0 or 16 or 32.  Likewise for ERF_DONT_STRIP_FCS (either 0 or 1).
       Remove FCS quirks specific to 4.2S and 4.23S.
-      DAG: Fix packet filtering with low snaplen.
+      Fix packet filtering with low snaplen.
 
 DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
   Summary for 1.10.6 libpcap release (so far!)

pcap-dag.c

@@ -571,7 +571,17 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 
 		} /* ERF encapsulation */
 
-		/* Run the packet filter if there is one. */
+		/*
+		 * In this libpcap module the two length arguments of
+		 * pcapint_filter() (the wire length and the captured length)
+		 * can have different values.
+		 *
+		 * The wire length of this packet is packet_len, which is
+		 * derived from ERF wlen; the captured length of this packet
+		 * is caplen, which is derived from ERF rlen, which in turn
+		 * depends on the card/stream slen; the snapshot length
+		 * configured for this pcap handle is p->snapshot.
+		 */
 		if ((p->fcode.bf_insns == NULL) || pcapint_filter(p->fcode.bf_insns, dp, packet_len, caplen)) {
 
 			/* convert between timestamp formats */