https://bugs.launchpad.net/ubuntu/+source/tcpdump/+bug/369288 Rediffed to apply. diff -Nuar --exclude '*.orig' --exclude '*.rej' libpcap-1.0.1-20090708.orig/pcap-linux.c libpcap-1.0.1-20090708/pcap-linux.c --- libpcap-1.0.1-20090708.orig/pcap-linux.c 2009-07-08 11:52:08.000000000 +0000 +++ libpcap-1.0.1-20090708/pcap-linux.c 2009-08-29 20:47:44.951806355 +0000 @@ -2785,6 +2785,19 @@ handle->fd, errno, pcap_strerror(errno)); return -1; } + + /* poll() sometimes returns > 0 even in error cases + * and sets error-bits like POLLERR, POLLHUP, .. + * Are also "good" bits are possible, like POLLPRI. + * TODO: what's with POLLRDHUP since kernel 2.6.17? + */ + if (ret > 0 && pollinfo.revents & (POLLERR | POLLHUP | POLLNVAL)) { + snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, + "critical revent in poll on packet socket fd %d: 0x%4.4x", + handle->fd, pollinfo.revents); + return -1; + } + /* check for break loop condition on interrupted syscall*/ if (handle->break_loop) { handle->break_loop = 0;