ngrep -W byline output is garbled

[jpr5]

ngrep -W byline output is garbled

[jpr5]

Hey @kenstir ,

Sorry for the tardy reply, and thanks so much for the bug report and helpful pcap file.

I think the culprit may be Linux cooked sockets. Latest master produces the same error message with your pcap file. From that report, I was able to repro with ngrep -d any '' udp, FYI.

I'm looking into it now.

[jpr5]

OK, I think I got it in ce64df4 on master.

It looks like there've been many reports of this, in different ways; it even looks like there's an outstanding pull request around loopback processing that also solves this at its core (can't be sure as it doesn't say so, but probably not an accident).

I've run your pcap through and it shows fine. Would you mind confirming for me, in your own environment?

In any case, appreciate the report and the opportunity to make ngrep better.

cheers,
--jordan

[kenstir]

That fix works for me, thanks very much indeed!