tcpdump icon indicating copy to clipboard operation
tcpdump copied to clipboard

tcpdump sometimes prints the packet hex dump twice for unsupported DLTs

Open infrastation opened this issue 3 weeks ago • 0 comments

For an unsupported DLT the hex dump output is implicit:

$ ./tcpdump -n -r tests/unsupported-link-type-160.pcap 
reading from file tests/unsupported-link-type-160.pcap, link-type 160, snapshot length 102400
01:00:00.000000 UNSUPPORTED
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b  I.b.i#4.....N..;
	0x0010:  43e0 0b2b 2b2b 2b                        C..++++

Explicit -X and -XX add another hex dump of the same data in exactly the same format:

$ ./tcpdump -n -r tests/unsupported-link-type-160.pcap -X
reading from file tests/unsupported-link-type-160.pcap, link-type 160, snapshot length 102400
01:00:00.000000 UNSUPPORTED
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b  I.b.i#4.....N..;
	0x0010:  43e0 0b2b 2b2b 2b                        C..++++
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b  I.b.i#4.....N..;
	0x0010:  43e0 0b2b 2b2b 2b                        C..++++

$ ./tcpdump -n -r tests/unsupported-link-type-160.pcap -XX
reading from file tests/unsupported-link-type-160.pcap, link-type 160, snapshot length 102400
01:00:00.000000 UNSUPPORTED
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b  I.b.i#4.....N..;
	0x0010:  43e0 0b2b 2b2b 2b                        C..++++
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b  I.b.i#4.....N..;
	0x0010:  43e0 0b2b 2b2b 2b                        C..++++

Explicit -x and -xx add another hex dump of the same data, but without the ASCII column:

$ ./tcpdump -n -r tests/unsupported-link-type-160.pcap -x
reading from file tests/unsupported-link-type-160.pcap, link-type 160, snapshot length 102400
01:00:00.000000 UNSUPPORTED
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b  I.b.i#4.....N..;
	0x0010:  43e0 0b2b 2b2b 2b                        C..++++
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b
	0x0010:  43e0 0b2b 2b2b 2b

$ ./tcpdump -n -r tests/unsupported-link-type-160.pcap -xx
reading from file tests/unsupported-link-type-160.pcap, link-type 160, snapshot length 102400
01:00:00.000000 UNSUPPORTED
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b  I.b.i#4.....N..;
	0x0010:  43e0 0b2b 2b2b 2b                        C..++++
	0x0000:  490c 6209 6923 34e8 efd3 a7bf 4ec0 fd3b
	0x0010:  43e0 0b2b 2b2b 2b

infrastation avatar Nov 16 '25 14:11 infrastation