Limitations of cppcap

[Václav_Brožík]

I wanted to try to use cppcap instead of tcpdump (on R80.20 + JHFA33) but I have encountered serious limitations which prevented me from using it on bridged interfaces:

• cppcap is not capturing VLAN tagged frames! Only untagged frames are captured. When I use explicit filter "vlan" to capture only tagged frames - the capture is always empty.
• Only "Out" direction was captured. "In" direction was working only on routed interfaces / interfaces with an IP address.

So on a gateway in bridge mode cppcap is almost completely unusable for me and I have to stay with good old tcpdump.

Are these limitations known? Are they going to be resolved? Did you encounter other limitations?

---

Otherwise cppcap has a great potential for becoming a very useful tool. Please consider supporting pcapng format and storing the interface and packet direction information into the capture file.

[HeikoAnkenbrand]

Hi Václav,

you can found more informations here:

R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP 

I dont‘t use firewalls in bridge mode but I had the same issue in a bridge mode LAB environment.

I think it is an TAC theme.