Well, I found out more about this problem. It turns out that I
was running tcpdump with the default snap length, and most of the
names where falling of the end of the packet (i.e. only part of
the name was contained, the rest was being truncated). The
name_*() routines were assuming the whole packet had been captured,
instead of just part of it.
This is a bug. Sure, I can run tcpdump -s 1500 on an ethernet and
that fixes this problem, but at a penalty. The code should work
no matter what the snaplen is...
I'd submit a patch myself, but I've got other fish to fry (did
someone shout "Cop out!"?).
-Philip