Closed chytreg closed 8 years ago
According to the tcpdump documentation it should be possible: http://www.tcpdump.org/manpages/pcap_open_dead.3pcap.html
We dont 'setfilter' on open_dead. We just use it for bpf compile checks.
Given that.. if still should not SEGFAULT..
[2] pry(main)> require 'pcaprub'
=> true
[3] pry(main)> capture = PCAPRUB::Pcap.open_dead(Pcap::DLT_NULL, 65535)
=> #<PCAPRUB::Pcap:0x00000002a31810>
[4] pry(main)> capture.compile('net 10.0.0.0/8')
=> #<PCAPRUB::Pcap:0x00000002a31810>
[5] pry(main)>
Fixed in 0.12.4 ruby gem.
Now raises PCAPRUB::BPFError if you attempt set a filter on a OPEN_DEAD link
./test_open_dead.rb:4:in `setfilter': unable to set bpf filter on OPEN_DEAD (PCAPRUB::BPFError)
from ./est_open_dead.rb:4:in `<main>'
Backtrace here: