topic Re: tcpdump in Operating System - HP-UX

tcpdump

Gilles Salvin — Wed, 10 Apr 2002 07:35:07 GMT

Hello
I'm trying to use the tcpdump tool for the first time
and I encounter some difficulties
>tcpdump -i lan1 host pcntpe25
tcpdump: recv_ack: promisc_phys: Invalid argument

>tcpdump -i lan2 host pcntpe25 OK
Can anyone help me please
BR

Re: tcpdump

Roger Baptiste — Wed, 10 Apr 2002 08:05:05 GMT

hi,

Make sure you installed libpcap before installing tcpdump. You can get the downloadables from
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcpdump-3.6.2/

It worked fine for me.

HTH
raj

Re: tcpdump

Gilles Salvin — Wed, 10 Apr 2002 10:28:08 GMT

Hi RajMan
Thank you for answering :o)
The products were pre-installed by HP, so I guess it's correct.
It works well on lan2 interface which is a backup-lan for MC/Service-Guard but not on lan1 which is the active lan interface with 3 ip-addresses
1 for host and 2 for packages
that's all what's different
If you got any idea ...
BR

Re: tcpdump

Clemens van Everdingen — Wed, 10 Apr 2002 10:36:43 GMT

Hi,

Can you give the output from:
# ifconfig lan1

And

# ifconfig lan2

Might give some clue !

Clemens

Re: tcpdump

Gilles Salvin — Wed, 10 Apr 2002 10:44:17 GMT

Hello Clemens van Everdingen
thank you for answering :o)
see-below the result of commands

root(hardy)/root-#ifconfig lan1
lan1: flags=843
inet 172.29.102.34 netmask ffff0000 broadcast 172.29.255.255
root(hardy)/root-#ifconfig lan2
lan2: flags=842
inet 0.0.0.0 netmask ffffffff

Just notice that it doesn't work on a other server of my cluster (same hardware) but it
works on a third one with FDDI
interfaces instead of 100BT
B

Re: tcpdump

Clemens van Everdingen — Wed, 10 Apr 2002 10:56:55 GMT

Hi,

Are you running 10.20 or 11.00 (32 or 64 bits) ?

Clemens

Re: tcpdump

Gilles Salvin — Wed, 10 Apr 2002 10:58:23 GMT

Clemens
It's 11.00 64 bits
br

Re: tcpdump

Clemens van Everdingen — Wed, 10 Apr 2002 11:24:15 GMT

Hi,

Could you try to run tcpdump as follows:

# tcpdump -p -i lan1 host pcntpe25

Extract from porting archive:

-p Don't put the interface into promiscuous mode.
Note that the interface might be in promiscuous mode for some other reason;
hence, `-p' cannot be used as an abbreviation for `ether host {local-hw-addr} or ether broadcast'.

See:

http://hpux.cict.fr/hppd/hpux/Networking/Admin/tcpdump-3.6.2/man.html

Let me know the results.

Regards,
Clemens

Re: tcpdump

Gilles Salvin — Wed, 10 Apr 2002 11:31:23 GMT

Clemens
very good idea (I hav'nt seen it into the man) but it doesn't
solve the problem :o(

Re: tcpdump

Clemens van Everdingen — Wed, 10 Apr 2002 11:37:39 GMT

Hi,

Output still with the same error message ??

C.

Re: tcpdump

Gilles Salvin — Wed, 10 Apr 2002 11:44:18 GMT

Clemens
No ; not exactly the same;
now it is
cpdump: recv_ack:
promisc_sap: Invalid argument

before it was:
cpdump: recv_ack: promisc_phys: Invalid argument

Re: tcpdump

Clemens van Everdingen — Wed, 10 Apr 2002 12:12:45 GMT

Hi Gilles,

For now I am out of clues.
Will think and search about the new error.

It has to do with the difference in cards and the promiscues mode of the failing card.

Regards,
Clemens

Re: tcpdump

Gilles Salvin — Wed, 10 Apr 2002 13:04:16 GMT

Hi Clemens
I was looking at
http://www.tcpdump.org/
in order to get help but
don't find anything :o(
Anyway thank you very much
for the time you spent on my request.
Regards
Gilles

Re: tcpdump

Clemens van Everdingen — Thu, 11 Apr 2002 05:33:50 GMT

Hi Gilles,

Sorry that I could not be of more assistance.
I think we need a networking expert for this.

Anybody ?

Regards,
Clemens

Re: tcpdump

sven verhaegen — Thu, 11 Apr 2002 08:30:17 GMT

hello
I had a look at the error and found out the libcap had a bug in previous version , the error however was completely different from yours

"tcpdump: recv_ack: info unexpected primitive ack 0x0"

and was seen as a bug in lipcab itself , HP-labs notified for that the 3rd party vendor of tcpdump and lipcab but by now installing the glatest library that should be ok , however I did come up with a similar case , turns out this was caused by some sort of incompatibility between the tcpdump and the lancard itself , in that case it was solved by installing the latest card driver patch and the latest arpa transport patch , both can be downloaded through the ITRC , I don't know what patchlevel you are on this moment but this is the error the problem I looked at generated , it looks a bit like yours (but not 100%) it's worth trying to install latest patches , it might just solve the issue , error encountered :

tcpdump net 194.52.173

WARNING: DL_PROMISC_MULTI failed
(recv_ack: promisc_multi: Invalid argument)

Re: tcpdump

Matthew Pearce — Fri, 18 Feb 2005 01:15:50 GMT

For what it's worth, I received this error when trying to run a 2nd instance of tcpdump:

tcpdump: recv_ack: promisc_phys: UNIX error - Invalid argument

Did this on HPUX 11i.

After doing a ps and finding the first instance of tcpdump and killing it, I found that I could run tcpdump again without problems.