After upgrading to -r6 which includes Debian's new patchset, urlsnarf can exit early and also it's not possible to read from /dev/stdin anymore. The patch that caused is: 23_urlsnarf_timestamp.patch Which can actually be fixed in a better way. See patch on this page and also description of the same problem: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742786 Reproducible: Sometimes Steps to Reproduce: 1. run urlsnarf on an interface (preferably a high load interface). 2. urlsnarf exits because pcap_next_ex() in the main loop returns 0 (timeout). 3. run again with older dsniff/urlsnarf.. it keeps working, no early exit. Actual Results: urlsnarf exits the main pcap loop. Expected Results: urlsnarf keeps working, not exiting the main loop. Also, since this patch it is not possible to read pcap data from stdin anymore: $ sudo tcpdump -i eth0 -s0 -w - -c 100 | urlsnarf -n -p /dev/stdin Password: urlsnarf: using /dev/stdin [tcp port 80 or port 8080 or port 3128] pcap_open_offline(/dev/stdin): unknown file format
Created attachment 373742 [details, diff] Better timestamp patch. A better patch to fix the timestamp issue in urlsnarf. This replaces on of Debian's patches. This will also make sure that reading from /dev/stdin als pcap file keep working.
Since -r6 we're using Debian's patch set, so we might wait for them to update that.
(In reply to Jeroen Roovers from comment #2) > Since -r6 we're using Debian's patch set, so we might wait for them to > update that. Well, that didn't happen. I replaced patch 23 in Gentoo revision -r8.
