NMAP on HP-UX 11.00

[Paul R. Dittrich]

Feeling stupid here. I've just installed

nmap-2.53-sd-11.00
glib-1.2.9-sd-11.00
gtk+-1.2.9-sd-11.00

All swinstall'ed without problems, but....every time I try to execute nmap I get the following error message:

"pcap_open_live: can't find PPA for /dev/lan2"

What have I missed / mis-configured???

Thanks in advance for all replies.

Paul

[David Lodge]

This is strange - I had no problems on my workstation (but I compiled it from source)

It sounds like it cannot access all information about your lan interface. Is lan2 set up properly and has all the device files?

Try doing an 'ioscan -fnkC lan' and seeing whether it returns devices for your lan adapters. I have only run nmap on workstations with 10Mbp adaptors though...

[Paul R. Dittrich]

David, yes lan2 is correctly setup - the system is working fine overall. I *think* the problem may be related to having three NIC's installed: 1 public network, 1 private network and 1 unconfigured spare.
I had assumed (!) that by using the pre-compiled SD versions that I would have no problems.

[Steve Bonds]

I'm having this same problem. Did anyone ever find a solution?

[Alan Nicholson]

I think I had the same problem when I installed it on my workstation. The problem is that nmap wants to use the dlpi interface rather than the lan driver to access the net, so you have to give it a lan device which uses the dlpi interface.

Use lsdev to find the major device number of the dlpi driver, delete your current /dev/lan2 device (remember to make a note of the major/minor numbers in case this is the wrong answer & you have to go back), mknod a new /dev/lan2 with the dlpi major number and the minor number of your "old" device.

e.g.
$ ll /dev/lan0
crw-rw-r-- 1 root sys 52 0x000000 Jun 21 2000 /dev/lan0
$ rm /dev/lan0
$ lsdev | grep dlpi
119 -1 dlpi pseudo
$ mknod /dev/lan0 c 119 0x000000

I think that'll work. Good luck :)

[T G Manikandan]

Hello,
/*
HP-UX 10.20 and 11.X can use tcpdump/libpcap as found at
ftp://ftp.ee.lbl.gov./ To select the interface to trace, one uses the -i
option and gives the interface name as "/dev/dlpiN" where N is the PPA
of the device. One uses lanscan to find PPAs. On 10.20, the PPA happens
to be the same as the Network Management ID (NMID) and is not the same
as the N in "lanN." On 11.X, the PPA happens to be the same as the Card
Instance number and happens to be the same as the N in "lanN." The
/dev/dlpiN specified to tcpdump/libpcap is not the same as the device
file /dev/dlpiM. What actually happens is tcpdump/libcap opens /dev/dlpi
and bind to PPA N. The /dev/dlpiM device files are for other uses.
*/

[Steve Bonds]

I just tried compiling the source from http://www.insecure.org (2.54BETA31) and it does not seem to have the annoying PPA problem that plagues the "pre-built" version from the HP-UX porting center.

I used the HP-UX C/ANSI C compiler since GCC with HP's "as" was coughing up lots of warnings because of a PA-RISC code level mis-synchronization. (GCC was generating PA-RISC 2.0 code, but "as" was trying to interpret it as PA-RISC 1.0 code.)

This worked for me:
$ export CC="cc -Ae"
$ ./configure
$ make
(lots of warnings about "Pointers are not assignment-compatible" and "Argument XX is not the correct type". These are probably a segfault waiting to happen, but I didn't investigate them.)

# ./nmap -sS -p80 -v -v
(got the expected output)

[Steve Bonds]

For some reason I'm now having problems with the "-sS" scan. Fortunately, "-sT" seems to work.

I also can't run any other libpcap applications while nmap is running. (i.e. tcpdump) but this seems to be a known problem with the rather broken HP-UX DLPI implementation.

Here's some good reading for anyone trying to get libpcap working on HPUX:

http://www.tcpdump.org/lists/workers/2001/04/msg00016.html

-- Steve

[Scott Van Kalken]

I compiled from source and also had no problems.