From owner-freebsd-questions  Mon Jul 14 05:25:49 1997
Return-Path: <owner-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id FAA17429
          for questions-outgoing; Mon, 14 Jul 1997 05:25:49 -0700 (PDT)
Received: from nexus.astro.psu.edu (nexus.astro.psu.edu [128.118.147.20])
          by hub.freebsd.org (8.8.5/8.8.5) with SMTP id FAA17424
          for <questions@FreeBSD.ORG>; Mon, 14 Jul 1997 05:25:47 -0700 (PDT)
Received: from mstar.astro.psu.edu by nexus.astro.psu.edu (4.1/Nexus-1.3)
	id AA29472; Mon, 14 Jul 97 08:25:47 EDT
Received: by mstar.astro.psu.edu (SMI-8.6/Client-1.3)
	id IAA00077; Mon, 14 Jul 1997 08:25:41 -0400
Message-Id: <19970714082540.58698@astro.psu.edu>
Date: Mon, 14 Jul 1997 08:25:40 -0400
From: Matthew Hunt <mph@astro.psu.edu>
To: Doug White <dwhite@resnet.uoregon.edu>
Cc: mark abrenio <mabrenio@usa.net>, questions@FreeBSD.ORG
Subject: Re: tcptrace
Reply-To: Matthew Hunt <mph@pobox.com>
References: <19970713130852.27665@astro.psu.edu> <Pine.BSF.3.96.970713213048.3780G-100000@localhost>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.76
In-Reply-To: <Pine.BSF.3.96.970713213048.3780G-100000@localhost>; from Doug White on Sun, Jul 13, 1997 at 09:32:33PM -0700
Sender: owner-questions@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

On Sun, Jul 13, 1997 at 09:32:33PM -0700, Doug White wrote:

> Thanks for the clarify.  The only thing I can think if is that the version
> of tcpdump in FreeBSD varies from the output that tcptrace is expecting.
> You might check the tcptrace docs and see if it requires certain flags.
> Also, make sure file 'foo' actually has valid data, perhaps you forgot to
> compile in bpf and the error is going into the file and not to the
> console. :)

I can eliminate the last possibility because I use tcpdump frequently,
and it would have lost much of its entertainment value by now if it
didn't work. :-)

A couple of months ago, tcptrace would successfully consume the output
of "tcpdump -w foo" without any special arguments.  Granted, it
segfaulted with annoying frequency, but it tried.  My best guess,
then, is that you may be right in that the output of FreeBSD's tcpdump
might vary from what tcptrace wants.  I may have to look into whether
the output format has changed in the past few months.

Matthew