Wireshark · Ethereal-dev: Re: [ethereal-dev] yep, damnit... it's the linux kernel screwing with the packet dat a...

[Guy Harris <guy@xxxxxxxxxx>]

> How annoying... Should ethereal do any handling of this, or should we
> consider it being broke, and not care?

Well, there might be some heuristics that could cope with it -
unfortunately, we'd have to know whether the capture file came from a
Linux system, and "we're running on Linux/not running on Linux" doesn't
necessarily correctly tell us that.

*I* consider the Linux mechanism broken - if you have a mechanism in
your OS that purports to deliver raw copies of all packets sent
from/received on your machine (or, if promiscuous, all packets on your
network segment), I think it reasonable to expect that you'll get the
raw data from those packets, exactly as they appeared on the wire.

If nothing else, they could perhaps do a copy-on-write on the packet, so
that the copy handed to the raw packet socket doesn't get munged, and do
so only if there *is* a raw packet socket.