expression rejects all packets

Bill Fenner fenner at research.att.com
Wed Sep 12 20:23:08 PDT 2001


I take it back; I do know what's going on after all.  The problem is that
gen_vlan() has a static variable that remembers whether it has adjusted
the offsets for the VLAN header yet; this static variable doesn't get
reset on the second pcap_compile() so the offset doesn't get adjusted
the second time around, so this is like "ether type 0x8100 and ether
type 0x800", which is why it optimizes to "reject all".

I'll see if I can come up with a fix.

  Bill



More information about the Bro mailing list