tcpdump

You can enable function instrumentation to print debug statements. This involves configuring and building libpcap with the --enable-instrument-functions flag and using the INSTRUMENT environment variable to control the output. The variable can be set to 'all' or 'a' to print all function names, 'global' or 'g' to print only global functions, or left unset to print nothing.

This is due to the default buffered mode in modern versions of libpcap on Linux, which waits for the packet buffer to fill or its timeout to expire. This behavior can be changed using pcap_set_immediate_mode() and pcap_set_timeout() to request immediate mode or adjust the timeout value.

The pcap-int.h file is an internal header and should not be included directly by programs. Some libpcap packages do not install internal headers, which can cause compilation failures. The correct solution is to modify the program to avoid including pcap-int.h.

The vlan and mpls keywords automatically increment the offset for subsequent keywords in the filter expression. This means that expressions like 'vlan 100 or vlan 200' may not match as expected. Rearranging the filter expression or using different primitives may help achieve the desired effect.

You can use the -T flag in tcpdump to decode specific protocols, such as RADIUS, on non-standard ports. For example, to decode RADIUS packets on port 21812, use: tcpdump -T radius -nv udp port 21812. Applying a packet filter to isolate the correct packets is recommended.

You need to install flex, as AT&T lex has some parameters set too low. Refer to the thread summary and libpcap generic installation notes for Solaris for more details.

This is not a memory leak but state accumulation. tcpdump keeps track of all connections to generate relative sequence numbers. To reduce this, run tcpdump with the -S flag to use absolute sequence numbers instead.

If you're capturing on a switched network, unicast traffic between two ports may not appear on other ports. Only broadcast and multicast traffic will be sent to all ports. Some switches allow replicating all traffic to a single port for monitoring.