This bug report may be a little too broad, but it is
I have Pcap savefiles (containing only IPv4+TCP
packets) captured on the loopback device (DLT_NULL) of
an old big-endian Mac laptop. These savefiles are now
on my little-endian Linux 2.6.9 workstation.
I needed to chop off the first 1000 packets, so I used
tcpdump with -c, -r, and -w to do so.
The trouble is, capture filters absolutely don't work
(i.e., everything gets filtered out) on the "chopped"
Pcap file using tcpdump. Even a filter as
unrestrictive as "ip" produces no results. Capture
filters work fine on the original file.
Without any capture filter, 'tcpdump -vvv' shows
exactly the same output on the first 1000 packets in
the original file and the "chopped" file.
Strangely, capture filters *do* work on the chopped
file using tethereal.
I have been troubleshooting this for a while, and one
interesting thing I found is that if I convert the
original Pcap file with 'tethereal' (again with -c, -
r, -w), capture filters (using tcpdump) will also fail
on the generated file, but filtering with tethereal
I even went so far as writing my own pcap-based
application to "chop" a given number of packets and
write to a savefile; capture filters (using tcpdump)
don't work on that either, but filters using tethereal
again works fine.
Also, I wrote my own pcap application for applying a
capture filter to a savefile and print out some debug
information about what packets actually pass the
filter. The application processes the original
savefile fine, but (like tcpdump) filters out all
packets on the "chopped" file with a filter as simple
Since chopping with either tcpdump, tethereal, or my
own pcap application leads to capture filter problems,
it seemed appropriate to file the bug against libpcap.
I'm not sure if the core of the problem lies in the
difference in endianness between the "capture machine"
and my Linux workstation, or if it's something to do
It would probably be helpful to post the original Pcap
file online, but it was captured on a colleague's home
network so I'll need to get his permission to do so. I
was hoping that the above description might be enough
to get started.