#7 fails with galeon/mozilla over loopback device

[Jos Dehaes]

env: linux 2.5.67, ssldump 0.9b3, apache 2.0.45,
mozilla 1.3, IE 5.5

when using ssldump to sniff traffic between apache 2.0
and mozilla/galeon this error stops the sniff during
the first connection:

ERROR: Length mismatch

This is on the loopback device, but I don't know if
that has anything to do with it. It's no problem with
apache and IE, but that's evidently not over the
loopback device.

[Jos Dehaes]

Logged In: YES
user_id=36027

I can confirm now it is a loopback problem, ssldump has no
problem sniffing galeon/mozilla traffic over normal interfaces.

[klutz]

Logged In: YES
user_id=1024906

pcap_snoop.c calls pcap_open_live with hard-coded 5000
byte max snaplen.

Loopback interface on my RedHat installations defaults to MTU
of 16436, so those occasional big packets cause the length
mismatch. Ethernet MTU is only 1500, so you'll never see
that error.

Either use ifconfig to reduce loopback MTU, or change
pcap_snoop.c to use a 17k buffer size (or even better, make
it configurable). tcpdump doc says large snapshots might
cause dropped packets.