diff --git a/CHANGES b/CHANGES index 57b1e0fa48..3e15af2530 100644 --- a/CHANGES +++ b/CHANGES @@ -85,6 +85,8 @@ DayOfTheWeek, Month DD, YYYY / The Tcpdump Group 0 or 16 or 32. Likewise for ERF_DONT_STRIP_FCS (either 0 or 1). Remove FCS quirks specific to 4.2S and 4.23S. Fix packet filtering with low snaplen. + SNF: + Fix packet filtering with low snaplen. DayOfTheWeek, Month DD, YYYY / The Tcpdump Group Summary for 1.10.6 libpcap release (so far!) diff --git a/pcap-snf.c b/pcap-snf.c index a9b4f5d055..959cf20f7a 100644 --- a/pcap-snf.c +++ b/pcap-snf.c @@ -182,12 +182,21 @@ snf_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) } } + /* + * In this libpcap module the two length arguments of + * pcapint_filter() (the wire length and the captured length) + * are always equal because SNF captures full packets. + * + * The wire and the capture length of this packet is + * req.length, the snapshot length configured for this pcap + * handle is p->snapshot. + */ caplen = req.length; if (caplen > p->snapshot) caplen = p->snapshot; if ((p->fcode.bf_insns == NULL) || - pcapint_filter(p->fcode.bf_insns, req.pkt_addr, req.length, caplen)) { + pcapint_filter(p->fcode.bf_insns, req.pkt_addr, req.length, req.length)) { hdr.ts = snf_timestamp_to_timeval(req.timestamp, p->opt.tstamp_precision); hdr.caplen = caplen; hdr.len = req.length;