Since it seems that tcpdump people are more or less gone, is it still too much to ask that the broken code in src/contrib/libpcap/pcap-bpf.c starting from line 236 which breaks the bufsize would be removed from the FreeBSD repository? Obviously the option is to fix the code but that´s much more work :) Pete