Re: tcpdump broken wrt CsCov & CsVal parsing?

[Gerrit Renker <gerrit@erg.abdn.ac.uk>]

|  I checked locally:
|  >  * tcpdump 3.9.5 as Debian package with libpcap 0.9.5 has this swap-problem 
|  >  * tcpdump 3.9.5 built from tcpdump source, with libpcap 0.9.4 works correct
|  > 
|  > Can you try tcpdump from source please and check if the problem persists?
|  
|  Excellent data point, I should know better and try with upstream before
|  complaining. Ah, and also provide the tcpdump version:
|  
|  [root@tonchinha ~]# rpm -q tcpdump
|  tcpdump-3.9.7-3.fc8
Have you looked at the source rpm's? I found the old patch, if the following hunk
applies then quite likely they have forgotten to patch the header file, and the
problem could be solved then (CCval and Cscov were swapped):

--- a/dccp.h
+++ b/dccp.h
@@ -36,8 +36,8 @@ struct dccp_hdr {
 	}		dccph_xtrs;
 };
 
-#define DCCPH_CCVAL(dh)	(((dh)->dccph_ccval_cscov) & 0x0F)
-#define DCCPH_CSCOV(dh)	(((dh)->dccph_ccval_cscov >> 4) & 0x0F)
+#define DCCPH_CCVAL(dh)	(((dh)->dccph_ccval_cscov >> 4) & 0xF)
+#define DCCPH_CSCOV(dh)	(((dh)->dccph_ccval_cscov) & 0xF)
 
 #define DCCPH_X(dh)	((dh)->dccph_xtrs.dccph_xtr & 1)
 #define DCCPH_TYPE(dh)	(((dh)->dccph_xtrs.dccph_xtr >> 1) & 0xF)