From nobody@FreeBSD.org  Fri Mar 23 01:09:47 2007
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id B2E0D16A400
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 23 Mar 2007 01:09:47 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [69.147.83.33])
	by mx1.freebsd.org (Postfix) with ESMTP id A18BF13C480
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 23 Mar 2007 01:09:47 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l2N19lmS012568
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 23 Mar 2007 01:09:47 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id l2N14jmT011312;
	Fri, 23 Mar 2007 01:04:45 GMT
	(envelope-from nobody)
Message-Id: <200703230104.l2N14jmT011312@www.freebsd.org>
Date: Fri, 23 Mar 2007 01:04:45 GMT
From: Charles Sprickman<spork@bway.net>
To: freebsd-gnats-submit@FreeBSD.org
Subject: tcpdump ipv4 snaplen too short for pflog
X-Send-Pr-Version: www-3.0

>Number:         110689
>Category:       bin
>Synopsis:       tcpdump ipv4 snaplen too short for pflog
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Fri Mar 23 01:10:04 GMT 2007
>Closed-Date:    Fri Mar 23 06:43:47 GMT 2007
>Last-Modified:  Fri Mar 23 06:43:47 GMT 2007
>Originator:     Charles Sprickman
>Release:        6.2-Release
>Organization:
spork, LLC
>Environment:
[root@slimjim /usr/src/usr.sbin/tcpdump]# uname -a
FreeBSD slimjim.bway.net 6.2-RELEASE-p1 FreeBSD 6.2-RELEASE-p1 #4: Thu Feb 15 17:53:43 EST 2007     spork@slimjim.bway.net:/usr/obj/usr/src/sys/ENO  i386
>Description:
There is a ifdef in the tcpdump sources (I believe just in /usr/src/contrib/tcpdump/interface.h) that sets the default snaplen for tcpdump.  Running tcpdump without a special snaplen against pflog will drop some data (the last octet of the second ip).

This breaks things like spamlogd (/usr/ports/mail/spamd).

The issue is also raised here in the NetBSD bug db:

http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=34733

Same issue...  
>How-To-Repeat:
Build a recent spamlogd on FreeBSD, try to run it.  You'll see that the traffic it snarfs from pflog is missing the last octet, which makes it unhappy:

Mar 22 03:03:31 slimjim spamlogd[700]: outbound 216.220.96
Mar 22 03:03:31 slimjim spamlogd[700]: invalid ip address 216.220.96
>Fix:
I rebuilt tcpdump after setting the snaplen to 96 in both cases.  Some would argue that the ifdef is not even really necessary and a snaplen big enough to deal with all our "new" interfaces (pflog, carp, etc.) should be the new default.

This snippet starts at line 87.

/*
 * The default snapshot length.  This value allows most printers to print
 * useful information while keeping the amount of unwanted data down.
 */
#ifndef INET6
#define DEFAULT_SNAPLEN 96      /* ether + IPv4 + TCP + 14 */
#else
#define DEFAULT_SNAPLEN 96      /* ether + IPv6 + TCP + 22 */
#endif                           /*   ^^ I upped this */
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: remko 
State-Changed-When: Fri Mar 23 06:43:45 UTC 2007 
State-Changed-Why:  
Please raise this with the tcpdump maintainers, they can change this and 
we can import the new version if needed. Since this is a 
vendor/contributed item, we are not going to change that locally. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=110689 
>Unformatted:
