[Pandora] Re: extrange behaviour of tcpscan component

[uaca]

I would append to my previous e-mail that I've tried both pandora's builtin
libpcap and libpcap-0.7 versions with the same results

Thanks

        Ulisses

On Mon, Dec 02, 2002 at 05:47:51PM +0100, ulisses wrote:
> 
> Hi all again!
> 
> while doing some tests on pandora I found that the following stacks doesn't
> print the same amount of packets
> 
> %prova12ip {
> #       @pcap [ $device = "eth0" ];
>       @pcap [ $file = "/home/ulisses/prova11.dump" ];
> #      @ipfragswitch (
> #                        @demux [ $algo = "ipquad" ]
> #                        < @ipreass [ $timeout = 30 ] >
> #                    )
>       @print;
>       @discard;
> }
> 
> %prova12tcp {
>       @pcap [ $file = "/home/ulisses/prova11.dump" ];
> #      @ipfragswitch (
> #                        @demux [ $algo = "ipquad" ]
> #                        < @ipreass [ $timeout = 30 ] >
> #                    )
>       @tcpscan;
>       @print;
>       @discard;
> }
> 
> 
> Please note that I don't use defragmentation components, also packets are not
> fragmented
> 
> the dump referenced here is at http://pusa.uv.es/~ulisses/pandora/
> 
> Any comment would be greatly apreciated
> 
>       Ulisses
> 
> 
>                 Debian GNU/Linux: a dream come true
> -----------------------------------------------------------------------------
> "Computers are useless. They can only give answers."            Pablo Picasso
> 
> --->  Visita http://www.valux.org/ para saber acerca de la    <---
> --->  Asociación Valenciana de Usuarios de Linux              <---
>  

-- 
                Debian GNU/Linux: a dream come true
-----------------------------------------------------------------------------
"Computers are useless. They can only give answers."            Pablo Picasso

--->    Visita http://www.valux.org/ para saber acerca de la    <---
--->    Asociación Valenciana de Usuarios de Linux              <---