[tcpdump-workers] localhost on Solaris

Hi ! I understand there is no solution to sniffing for local traffic on Solaris since the kernel always used the loopback interface for that. I suggest to write a STREAMS module to sit on top of the loopback driver. Does anyone know if the loopback driver is a STREAMS driver ? (Say, Solaris 8 a

Re: [tcpdump-workers] localhost on Solaris

Thanks for the answer! There is nothing similar to ip_loopback_bypass in Solaris. When I run netstat -i, I do see packets that are "passed through" the localhost interface. Is there a real entity in the kernel which is the loopback interface, may it be a driver (seems not to be one), STREAMS mo

Re: [tcpdump-workers] localhost on Solaris

OK... Assuming I insist on enabling localhost sniffing on Solaris to the benerfit of all: How should I approach it? How about pushing a STREAMS module on top of the TCP driver? ( Is *that* a STREAMS driver nowdays?) --ury --- Rick Jones <[EMAIL PROTECTED]> wrote: > ury se

Re: [tcpdump-workers] handling tcp retransmissions with libpcap

> > looking at snort. > > libnids is *perfect*, thank you :) Does it handle lost segments well? I mean, when you never get a segment, will NIDS understand that, give up on the segment, and continue feeding the user with the rest of the stream? Similarly, does it track connections without captu

[tcpdump-workers] EAGAIN from pcap_dispatch

Hi, I have pcap_dispatch sometimes returning value <0 and pcap_geterr printing "Resource temporarily unavailable". The pcap handler is non blocking (pcap_setnonblock was called with 1), the fd was found with pcap_get_selectable_fd, it was select()ed on and returned turned on. Yet pcap_dispatch r

Re: [tcpdump-workers] EAGAIN from pcap_dispatch

) < 0 )) { printf("Reading packet: %s",pcap_geterr(pcaph)); } What I see is : Reading packet: Resource temporarily unavailable Is this because there are no packets to read? --- Guy Harris <[EMAIL PROTECTED]> wrote: > > On Apr 15, 2005, at

[tcpdump-workers] EAGAIN from pcap_dispatch

Hi, I am trying to run this small sample program on Solaris 2.8, using pcap 0.8.3 on solaris 8. All I get when I run this is: pcap_dispatch: Resource temporarily unavailable every select timeout. In a gdb session I see that the fd I got from get_selectable_fd is set, so I call pcap_dispatch. T

[tcpdump-workers] Link to pcap-0.9.0 broken

Hi, The link to pcap-0.9.0-096.tar.gz in www.tcpdump.org is broken. Thanks --ury - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] EAGAIN from pcap_dispatch

packets in Linux. Also, this is a strip-down of something else that select()s on more than one fd, so the select() is kind of silly here... I'll try to compile with the latest version. Thanks again! --- Guy Harris <[EMAIL PROTECTED]> wrote: > ury segal wrote: > > > Any

Re: [tcpdump-workers] one more thing

Your error was that you did not save the return value from pcap_open_live. It's not related to the ! operator. You can keep on using ! if you want. Change your original errornous > if (!(pcap_open_live(iface, snaplen, 0, -1, errbuf))) to if (! (pfd = pcap_open_live(iface, snaplen, 0, -1, errbuf))

Re: [tcpdump-workers] pcap_loop segfaults

Just to same you some pain, here is another error in your program: Look at your die() function: void die (_Bool onoff, char *text, ...) { va_list(args); va_start(args, text); vfprintf(stderr, text, args); va_end(args); fflush(stdout); if (errno &&

[tcpdump-workers] bpf read() returns with EINVAL on AIX 5.2

Hi! I'm having a weird problem on AIX 5.2. I have a program that opens en0 and installs the following filter : ((tcp[0:2] > 4 and tcp[0:2] < 50001) or (tcp[2:2] > 4 and tcp[2:2] < 50001)) and ( net 0.0.0.0 mask 0.0.0.0 ) It runs well for a while. If I truss it I see a lot of lines like

Re: [tcpdump-workers] bpf read() returns with EINVAL on AIX 5.2

receives EINVAL from every read on the bpf socket. However, this does NOT happen if I use libpcap 0.8.1 . I suspect that something has changed between 0.8.1 and the version that is now in cvs. This happens both on Uni-processor and SMP. Thanks! --- Ury Segal <[EMAIL PROTECTED]> wrote:

Re: [tcpdump-workers] How to use "pcap" on a router ???

Hi! I'd prefer calling "pcap_open_live()" twice, set the appropriate filters (which may be different), call "get_selectable_fd()" on each pcap_t, and then use select() to pick up packets from any interface that may have some ready. That way I don't have to deal with threads. However on some si

Re: [tcpdump-workers] How to make libpcap work in MMAP mode

What do you mean by "MMAP mode" ? --- Öì¹úÔÆ <[EMAIL PROTECTED]> wrote: > Hi,everybody: > > I want to know how to make libpcap(version > 0.9.20060417) work in MMAP mode. Would somebody > give me some help? Thanks in advance! > > > - > This is the tcpdump-workers list. > Visit https://l

Re: [tcpdump-workers] Problems with libpcap and C++

The buttom of the problem is this: You excpect libpcap to call X::dumper in the context of an instance of class X. (The "real" first parameter of "X::dumper" is a variable named "this" of the type "X*".) But the libpcap API is not defining a >`void (X::)(u_char*, const pcap_pkthdr*, const > u_

[tcpdump-workers] Packet arrival order

Hi, I am running a local pcap application on a Solaris host, capturing only packets going to and from a specific interface. Sometimes I see several packets coming in, in a row, and then several packets going out, in a row, from that interface. However, I know (from the content of the packets a

Re: [tcpdump-workers] Packet arrival order

Hi! > I think you are seeing the same problem that I > have described in my posting "Not receiving >packets on Solaris, but no problems on Linux and > BSD". > > I think what we both need is the Solaris/DLPI > equivalent to the BSD/BPF BIOCIMMEDIATE ioctl. Do you happen to know what is the So