Re: libpcap: patches required for OpenSolaris/SXCE

[Sebastien Roy <Sebastien.Roy () Sun COM>]

On Tue, 2009-12-01 at 18:48 -0800, Guy Harris wrote:
> On Dec 1, 2009, at 6:37 AM, Sebastien Roy wrote:
>
> > I would argue that it's a bug on Solaris that libpcap depends on
> > IP-layer information to choose a capture interface (if that is in fact
> > what it does),
>
> It depends on whatever mechanisms the OS provides that supply a list  
> of interfaces.  If the OS provides no mechanism that can supply  
> interfaces with no IP addresses, that's not a libpcap bug *on* the OS  
> in question, it's a deficiency *in* the OS in question.

Agreed.

> > bash-3.2# tcpdump -i bge0
> > tcpdump: WARNING: SIOCGIFADDR: bge0: No such device or address
>
> This means "sorry, if you're expecting -f to work or a filter  
> containing 'ip broadcast' to work, you're going to be disappointed".

Why not say exactly that?  The user likely doesn't know or care what
SIOCGIFADDR is.

> Does the errno corresponding to "No such device or address", when  
> returned by ioctl(SIOCGIFADDR), mean "this device doesn't have an  
> address of the type"?  Or can it also mean "there is no such device"?

It means that there is no IP interface named bge0.

> > The WARNING there seems spurious, and the use of SIOCGIFADDR
> > questionable.  Why should tcpdump care about the IP addresses assigned
> > to bge0 when observing at the link-layer?
>
> See above.  If pcap_lookupnet () fails, we can immediately report the  
> failure as an error if -f is specified, and possibly specify the out- 
> of-range netmask value to pcap_compile() if -f is not specified, and  
> have pcap_compile() report an error in that case.

Sounds good.

> > FWIW, it appears to select a
> > default interface just fine, so it would appear to not use the SIOCG*
> > socket ioctls for interface selection:
>
> Nope, it uses SIOCGLIFCONF.

But as shown in the ifconfig output, there was no IP interface named
bge0, so it couldn't possibly have obtained a default interface of bge0
from SIOCGLIFCONF.  According to truss, in the version of libpcap that I
have, it uses libdlpi's dlpi_walk(), which is a reasonable and supported
way of obtaining the list of datalinks on Solaris.  Even in the new
world where DLPI isn't used to actually capture, using dlpi_walk() to
walk datalinks would be a fine way to do this.

-Seb


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.