Re: "dnet: Failed to open device" errors on AIX, as root

[Ben Lentz <ben.lentz () gmail com>]

> It might help if you can try to compile and run this example code from
> IBM. If its bind works, but that of eth-ndd.c doesn't, then we can
> identify what the important differences are.
>
> http://pic.dhe.ibm.com/infocenter/aix/v6r1/topic/com.ibm.aix.progcomm/doc/progcomc/skt_sndother_ex.htm
>
> David Fifield

I was able to compile the "Sending Packets Over Ethernet Example
Program" and I was able to get it to run (I'm not totally clear on
what it's supposed to do) against both my local MAC address and the
MAC address of another system on the same network (10.0.17.0/24) so
long as I specified the ethernet type as 0x0, and not 0x800. As with
the problem that Peter reported, if 0x800 is used on AIX, it gives the
bind EEXIST error.

$ sudo ./sample en2 7e:ef:bb:08:f1:0c 0x800 10 10
src addr = 7EEFBB08F10C
dst addr = 7EEFBB08F10C
Ethertype: 800
Count: 10
Size: 60
bind: File exists

$ sudo ./sample en2 7e:ef:bb:08:f1:0c 0x0 10 10
src addr = 7EEFBB08F10C
dst addr = 7EEFBB08F10C
Ethertype: 0
Count: 10
Size: 60
$ sudo ./sample en2 9e:8b:f7:e6:00:0b 0x0 10 10
src addr = 7EEFBB08F10C
dst addr = 9E8BF7E6000B
Ethertype: 0
Count: 10
Size: 60

If I update libdnet-stripped/src/eth-ndd.c as follows:

$ /opt/local/diffutils/bin/diff -u libdnet-stripped/src/eth-ndd.c.orig
libdnet-stripped/src/eth-ndd.c
--- libdnet-stripped/src/eth-ndd.c.orig 2012-12-08 11:41:06.000000000 -0500
+++ libdnet-stripped/src/eth-ndd.c      2012-12-08 11:41:29.000000000 -0500
@@ -42,9 +42,9 @@
        sa.sndd_8022_family = AF_NDD;
         sa.sndd_8022_len = sizeof(sa);
        sa.sndd_8022_filtertype = NS_ETHERTYPE;
-       sa.sndd_8022_ethertype = ETH_TYPE_IP;
+       sa.sndd_8022_ethertype = 0;
        sa.sndd_8022_filterlen = sizeof(struct ns_8022);
-       strlcpy(sa.sndd_8022_nddname, device, sizeof(sa.sndd_8022_nddname));
+       strlcpy(e->device, device, sizeof(e->device));

        if (bind(e->fd, (struct sockaddr *)&sa, sizeof(sa)) < 0)
                return (eth_close(e));

It results in the following error:

$ sudo /opt/local/nmap/bin/nmap -sS 10.0.17.1

Starting Nmap 6.01 ( http://nmap.org ) at 2012-12-08 11:26 EST
WARNING:  eth_send of ARP packet returned -1 rather than expected 42
(errno=19: No such device)
WARNING:  eth_send of ARP packet returned -1 rather than expected 42
(errno=19: No such device)
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 0.46 seconds

Thank you for any help you can provide!
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/