Limitations of cppcap

Václav_Brožík — Fri, 15 Feb 2019 14:40:42 GMT

I wanted to try to use cppcap instead of tcpdump (on R80.20 + JHFA33) but I have encountered serious limitations which prevented me from using it on bridged interfaces:

cppcap is not capturing VLAN tagged frames! Only untagged frames are captured. When I use explicit filter "vlan" to capture only tagged frames - the capture is always empty.
Only "Out" direction was captured. "In" direction was working only on routed interfaces / interfaces with an IP address.

So on a gateway in bridge mode cppcap is almost completely unusable for me and I have to stay with good old tcpdump.

Are these limitations known? Are they going to be resolved? Did you encounter other limitations?

---

Otherwise cppcap has a great potential for becoming a very useful tool. Please consider supporting pcapng format and storing the interface and packet direction information into the capture file.

Re: Limitations of cppcap

HeikoAnkenbrand — Fri, 15 Feb 2019 17:01:01 GMT

Hi Václav,

you can found more informations here:

R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP

I dont‘t use firewalls in bridge mode but I had the same issue in a bridge mode LAB environment.

I think it is an TAC theme.

topic Re: Limitations of cppcap in General Topics

Limitations of cppcap

Re: Limitations of cppcap