Mailing List Archive

> I have installed the tcpdump with the libpcap library and it work correctly
> with '-i /dev/dlpi0'.
>
> I also installed the ethereal with its prereqs (libg, zlib,gtk+ and libpcap
> (already installed)), the graphical user interfce is fine, but when I try
> to start a capture session I got the following error:
>
> Can't use filter: Couldn't obtain netmask info (SIOCGIFADDR: /dev/dlpi0:
> invalid argument).

What does tcpdump print when you run it with "-i /dev/dlpi0"? Does it
print a message such as

tcpdump: WARNING: SIOCGIFADDR: /dev/dlpi0: invalid argument

If so, then there are two problems:

1) Ethereal doesn't just set the netmask to 0 if that happens -
this will probably be fixed at some point;

2) standard libpcap sucks on HP-UX (this is HP-UX, right?).

The solution to the second problem (if this is, indeed, on HP-UX) will
let you specify, in the "-i" flag to tcpdump and Tethereal, and in the
capture dialog box for Ethereal, the interface's name, rather than some
bogosity such as "/dev/dlpi0"; i.e., if you can do

ifconfig lan0

to get the status of some interface, you can do

tcpdump -i lan0

and

tethereal -i lan0

and can put "lan0" in the capture dialog box, which is the way tcpdump
and Tethereal and Ethereal (and other libpcap programs) are *supposed*
to work, even on HP-UX.

In the Ethereal source tarball from the Ethereal Web site, there's a
file "README.hpux", which discusses this and other issues, and there are
three files:

libpcap-0.4.HPUX.HPUXPAC.patch

libpcap-0.4.HPUX.LBL.patch

libpcap-0.5.HPUX.tcpdump.org.patch

which are patches to apply to the source code to libpcap; the
"README.hpux" file indicates how to figure out which patch to apply.
Apply that patch, and rebuild and reinstall libpcap; then rebuild
tcpdump (which will, after you rebuild it, take real interface names,
rather than "/dev/dlpi" names, for the "-i" flag) and Ethereal (which
will now take real interface names, rather than "/dev/dlpi" names, in
the capture dialog box).