Hi, Still have some more AIX problems. :) I'm not sure what I did to get things to work last week, because things are not working for me now. :( I downloaded the latest libpcap snapshot from http://www.tcpdump.org and compiled it. I configured it to use bpf, with --with-pcap=bpf. I have the following attached test program, which I compile with xlc -g -DHAVE_SA_LEN int1.c When I run it, the output is: Opened lo0 with pcap_open_live, pch=0 Opened lo0 with pcap_open_live, pch=0 Opened lo0 with pcap_open_live, pch=0 Opened en0 with pcap_open_live, pch=0 Opened en0 with pcap_open_live, pch=0 Now, if I run it through the debugger and step through things, I notice the following. Inside bpf_open(), in pcap-bpf.c, the following is called with device equal to "/dev/bpf0", which exists in the /dev directory on my system. fd = open(device, O_RDONLY); After this line, fd is set to 10, and errno is set to 0x4a, which is "No buffer space available" This causes pcap_open_live() to fail. I'm stumped....any ideas? -- Craig Rodrigues http://www.gis.net/~craigr rodrigc@xxxxxxxxxxxx
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <pcap.h>
#include <stdio.h>
#define WTAP_MAX_PACKET_SIZE 65535
int main(int argc, char *argv[])
{
int fd;
struct ifconf ifc;
struct ifreq *ifr, *last;
pcap_t *pch;
char err_str[PCAP_ERRBUF_SIZE];
fd = socket(AF_INET, SOCK_DGRAM, 0);
ifc.ifc_len = 1024 * sizeof(struct ifreq);
ifc.ifc_buf = (char *)malloc(ifc.ifc_len);
ioctl(fd, SIOCGIFCONF, &ifc);
ifr = (struct ifreq *) ifc.ifc_req;
last = (struct ifreq *) ((char *) ifr + ifc.ifc_len);
while (ifr < last){
pch = pcap_open_live(ifr->ifr_name, WTAP_MAX_PACKET_SIZE, 0, 0, err_str);
printf("Opened %s with pcap_open_live, pch=%p\n",ifr->ifr_name, pch);
#ifdef HAVE_SA_LEN
ifr = (struct ifreq *) ((char *) ifr + ifr->ifr_addr.sa_len + IFNAMSIZ);
#else
ifr = (struct ifreq *) ((char *) ifr + sizeof(struct ifreq));
#endif
}
return 0;
}
Powered by MHonArc 2.6.10