Ubuntu
libpcap package

Please sync libpcap 1.0.0-1 (main) from Debian unstable (main)

Bug #351591 reported by Mario Verbelen
6
Affects Status Importance Assigned to Milestone
libpcap (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Please sync libpcap 1.0.0-1 (main) from Debian unstable (main)

Motivation: the update fixes a bug where the any pseudo interface cannot be used in tcpdump.

The package builds fine in a jaunty pbuilder and installs and runs fine on a jaunty system. Tested with both tcpdump and wireshark.
It is a bug-fix only update. The soname remains unchanged: SONAME libpcap.so.0.8

The current version in jaunty does not have Ubuntu changes.

Changelog since current jaunty version:

 libpcap (1.0.0-1) unstable; urgency=low

   * Upload to unstable.
   * debian/libpcap0.8.shlibs: Bump to >= 1.0.0-1 (no real changes, just
     cosmetics).
   * debian/patches/20-fix-any-intf.diff: New patch cherry-picked from
     upstream; fixes handling of the 'any' device.
   * debian/patches/series: Update.

 -- Romain Francoise <email address hidden> Mon, 16 Feb 2009 19:24:03 +0100

-----------------------------------------------
Original description:

Binary package hint: tcpdump

root@jaunty:~# tcpdump -i any
tcpdump: SIOCGIFHWADDR: No such device

(specify other interface = no problem)
Version: 3.9.8-4ubuntu2
uname -a
Linux jaunty 2.6.28-11-generic #38-Ubuntu SMP Fri Mar 27 09:00:52 UTC 2009 i686 GNU/Linux

ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:1d:09:cf:65:83 brd ff:ff:ff:ff:ff:ff
3: wmaster0: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ieee802.11 00:1f:3b:41:c2:05 brd ff:ff:ff:ff:ff:ff
4: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ether 00:1f:3b:41:c2:05 brd ff:ff:ff:ff:ff:ff
5: pan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
    link/ether 5e:6b:55:c2:55:73 brd ff:ff:ff:ff:ff:ff
9: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    link/[65534]
10: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    link/[65534]
11: tun2: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    link/[65534]

See original description
Revision history for this message
Mario Verbelen (mario-verbelen) wrote :

tcpdump -D
1.eth0
2.tun0
3.tun1
4.tun2
5.lo

tcpdump -i eth0 -i tun0 -i tun1 -i tun2 -i lo
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 96 bytes

The network interfaces looks good
but still the "any" fails

Revision history for this message
Mario Verbelen (mario-verbelen) wrote :

strace tcpdump -i eth0 -i tun1 -i tun0 -i tun2 -c 1 2>&1|grep SIOCG
ioctl(3, SIOCGIFINDEX, {ifr_name="lo", ifr_index=1}) = 0
ioctl(3, SIOCGIFHWADDR, {ifr_name="tun2", ifr_hwaddr=00:00:00:00:00:00}) = 0
ioctl(3, SIOCGIFINDEX, {ifr_name="tun2", ifr_index=11}) = 0
ioctl(4, SIOCGIFADDR, {ifr_name="tun2", ifr_addr={AF_INET, inet_addr("10.8.0.54")}}) = 0
ioctl(4, SIOCGIFNETMASK, {ifr_name="tun2", ifr_netmask={AF_INET, inet_addr("255.255.255.255")}}) = 0

It looks like its only listning to the last parameter

strace tcpdump -i any -c 1 2>&1|grep SIOCG
ioctl(3, SIOCGIFINDEX, {ifr_name="lo", ifr_index=1}) = 0
ioctl(3, SIOCGIFHWADDR, {ifr_name="any", ???}) = -1 ENODEV (No such device)
write(2, "SIOCGIFHWADDR: No such device"..., 29SIOCGIFHWADDR: No such device) = 29

Revision history for this message
Albert Damen (albrt) wrote :

This is fixed in Debian, libpcap 1.0.0-1:

* debian/patches/20-fix-any-intf.diff: New patch cherry-picked from
     upstream; fixes handling of the 'any' device.

The any interface can be used in both tcpdump and wireshark again.

$ sudo tcpdump -D
1.eth0
2.wmaster0
3.wlan0
4.any (Pseudo-device that captures on all interfaces)
5.lo

Changing this bug into a sync request.

Albert Damen (albrt)
description: updated
Revision history for this message
Colin Watson (cjwatson) wrote :

Looks plausible. I'll sync this now, thanks.

Revision history for this message
Colin Watson (cjwatson) wrote :

[Updating] libpcap (1.0.0-1~exp1 [Ubuntu] < 1.0.0-1 [Debian])
 * Trying to add libpcap...
  - <libpcap_1.0.0-1.diff.gz: cached>
  - <libpcap_1.0.0.orig.tar.gz: already in distro - downloading from librarian>
  - <libpcap_1.0.0-1.dsc: cached>
I: libpcap [main] -> libpcap-dev_1.0.0-1~exp1 [main].
I: libpcap [main] -> libpcap0.8-dev_1.0.0-1~exp1 [main].
I: libpcap [main] -> libpcap0.8_1.0.0-1~exp1 [main].
I: libpcap [main] -> libpcap0.8-dbg_1.0.0-1~exp1 [main].

Changed in libpcap:
status: New → Fix Released
Revision history for this message
Mario Verbelen (mario-verbelen) wrote :

I did the update and the problem is solved

great, you can close this one
Thx Markske

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.