Is this bug still present in tcpdump? The fix is this simple:
--- print-ether.c.orig Sat Jun 11 02:01:29 1994
+++ print-ether.c Tue Sep 24 19:20:18 1996
@@ -94,6 +94,8 @@
if (eflag)
ether_print(p, length);
+ if (caplen>length)
+ caplen=length;
/*
* Some printers want to get back at the ethernet addresses,
* and/or check that they're not walking off the end of the packet.
olaf
--
___ Olaf.Titz@inka.de or @{stud,informatik}.uni-karlsruhe.de ____
__ o <URL:http://www.inka.de/~bigred/> <IRC:praetorius>
__/<_ >> Just as long as the wheels keep on turning round
_)>(_)______________ I will live for the groove 'til the sun goes down << ____