Guy Harris

> I would question whether that is a valid optimization, depending on the intended semantics of the language. I have seen nothing in the tcpdump man page, the pcap-filter man...

> The filter matches only with optimization disabled The filter `1/0 == 0` is _successfully compiled_ only with optimization disabled. Tcpdump doesn't even _run_ if you optimize that one, as...

The semantics _should_ be that an subexpression that makes an out-of-bounds reference or gets a {divide,modulo}-by-zero error evaluates to false, rather than causing the entire expression to return false. Unfortunately,...

Prior to 3.0, the VLAN auxiliary information for packets included a VLAN TCI field but did not include a flag to indicate whether the packet originally had a VLAN tag...

Submitted by doru001 This is a follow up to: https://sourceforge.net/tracker/?func=detail&aid=2813234&group_id=53066&atid=469573 which is going to be closed, as advised by: http://thread.gmane.org/gmane.network.tcpdump.devel/3997/focus=3999

Submitted by doru001 You may add that tcpdump works "outside" iptables. That is, it sees incoming packets stopped by iptables and it does not see outgoing packets stopped by iptables.

So did the kernel version change between then and now?

> FYI, the problem is replicated on OSX: If it's happening on macOS, it's not an issue with trying to deal with Linux's handling of VLAN tags (which requires that...

> so I can see the full contents of the packet to see whether it's encapsulated with something other than a regular LLC header with the LLC DSAP being 0x42...

> Without looking at the libpcap source for 'stp' I guess that it will only match on a ieee (and maybe dec) spanning tree BPDU but not on a vendor...