Wireshark · Ethereal-dev: Re: Re[2]: [ethereal-dev] ethereal-0.7.7 - hangs in recvfrom() on RH6.1

[Guy Harris <gharris@xxxxxxxxxxxx>]

> The problem is that redhat included a patch to libpcap that allows you to
> sniff on all interfaces at the same time. Well the also modified the pcap
> output to now contain an interface field for each packet. This is the
> source of the problem.

How would that cause the capture to hang?  I'd expect our capture code
to just ignore that extra information (given that we call
"pcap_open_live()" rather than "pcap_open_live_new()", we *shouldn't* 

The hang sounds more like the lack of the patch to cause the "to_ms"
argument to "pcap_open_live()" actually do something; at least in the
copy I grabbed of the RH 6.1 source, the "to_ms" argument doesn't do
anything in either "pcap_open_live()" or "pcap_open_live_new()".

> We could have ethereal check for that type of pcap
> output and automajically switch, but to get it working, I just installed
> to old tcpdump source rpm, applied the linux libpcap patch,

Applying the Linux libpcap patch may have been what fixed the problem
for you.