| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
|
|
|
| |
libpcap, ok dlg@
https://github.com/the-tcpdump-group/libpcap/commit/74b2de364f3443fc2414d0160b0b942f347c6fd4
https://github.com/the-tcpdump-group/libpcap/commit/117cb5eb2eb4fe212d3851f1205bb0b8f57873c6
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
the use of the sample keyword matches similar config in other
products.
NUM can be a number between 2 and 1048576, and is used to divide
0x100000000 into a threshold that is then compared against a randomly
generated number produced by a load of BPF_RND.
having sampling as part of the grammar means you can write things
like "icmp or sample 128". this lets you capture all icmp traffic
and a sample of the rest of the traffic.
ok jmatthew@ kn@ tb@
|
| |
|
|
|
|
|
|
|
|
| |
this adds "rnd" and "random" as keywords in the grammar, and handles
them as an arithmetic operator. the decoder recognises the load,
so tcpdump can print it as 'ld #random'. most of the handling is
copied from the "len"/"length" keywoard handling that generates and
decodes a load of the actual wire length of the packet.
ok jmatthew@ tb@ kn@
|
| | |
|
| |
|
|
| |
ok jmc
|
|
|
conversion suggested by deraadt, as well as renaming
from section 7 to section 5;
ok deraadt
|
sthen
dlg
jca
deraadt
jmc