static linking issue: libpcap depends on libnetlink about john HOT 5 CLOSED

Hmm, I suppose the last remark should be rephrased as "the pcap stuff built after john itself". Right now it's SIPdump and vcnpcap2john (nb. wpapcap2john does not use the pcap lib).

from john.

seems wpapcap provides its own pcap format parser, which is nice... however it looks like it only cares for little endian machines (it always does a bitswap, plus the ethernet hdr structs dont have endian-aware ifdefs in it, unlike our tcphdr.h)

from john.

I'm not 100% sure but I believe you are wrong and @jfoug is one of the better among JtR coders when it comes to endianity. In Process(), it reads the data right into a struct. But it then checks the main_hdr.magic_number for endianity and acts accordingly (swaps stuff).
Anyway that's OT for this issue :-)

from john.

ah lol then bROT means "need endian transform". when i glanced over the code it looked like some sort of pcap version check. quite non-obvious. it's also kinda unusual to have 2 different codepaths for endianness instead of just using ntohl() etc, which would get optimized to a NOP on big endian machines.

from john.

Static linking is currently out of scope for JtR out-of-the-box, and no-one seems to contribute to it. Closing.

from john.