topic Re: How to configure LAN card for no IP address.? in Operating System - HP-UX

How to configure LAN card for no IP address.?

pap — Tue, 04 Mar 2003 20:30:14 GMT

I am asked to configure the LAN card on HP-UX 11.0 with no IP, subnet assigned to it.

We want to do sniffer monitoring and traffic tracking by using this card.

ANy help is highly appreciated in advance.

-pap

Re: How to configure LAN card for no IP address.?

Ross Zubritski — Tue, 04 Mar 2003 20:45:36 GMT

Pap,

I beleive all you need to do is use the ifconfig unplumb" command.

Regards,

RZ

Re: How to configure LAN card for no IP address.?

Shannon Petry — Tue, 04 Mar 2003 20:48:42 GMT

You can not do this. By design, a NIC must be plumbed "and" given an IP address to be alive on a network and receive/send packets. Note that traffic will come to the NIC so it does not have to be on the same network or subnet.

Potential additional problems:
Switches with brains will not forward packets to this machine.

Having no IP assigned and wanting to view TCP/IP data is kind of like wanting a car with no drive train to do 120MPH.

Regards,
Shannon

Re: How to configure LAN card for no IP address.?

Shannon Petry — Tue, 04 Mar 2003 20:53:17 GMT

I should clarify. You can unplumb the nic but if you do this you will not be able to see TCP/IP traffic.

Re: How to configure LAN card for no IP address.?

James A. Donovan — Tue, 04 Mar 2003 21:22:02 GMT

It sounds like what you actually need to do is place the NIC into promiscuous mode. You'll have to assign it an IP address.

The tcpdump utility, when run, should automatically place the NIC of your choosing into promiscuous mode so that you can intercept all packets on that NIC's subnet.

You can download tcpdump from
here:
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcpdump-3.7.1/

Re: How to configure LAN card for no IP address.?

pap — Tue, 04 Mar 2003 21:50:04 GMT

Hi,
I am using "ethereal" package to view the traffic.

Thanks,

Re: How to configure LAN card for no IP address.?

Sridhar Bhaskarla — Tue, 04 Mar 2003 22:03:23 GMT

Hi Pap,

I use ethereal. You do not need to enable anything. DLPI streams subsystem will take care of it.

-Sri

Re: How to configure LAN card for no IP address.?

Ajit Natarajan — Wed, 05 Mar 2003 02:03:35 GMT

You do NOT need to have an IP address configured for each interface. Part of the confusion may be because SAM requires an IP address to be configured in the Networking and Communications -> Network Interface Cards configuration screen.

If you do not configure IP, you will not be able to use applications that use TCP/IP, UDP/IP, raw IP, etc., on that interface. So, for example you will not be able to use ftp, ping, telnet, and rlogin on that interface. Pure DLPI applications should work fine.

If you have the machine booted up and have an IP address configured on the interface, you can remove the IP address by doing

ifconfig lan unplumb

as root. In this command is the PPA of the interface.

(You can determine the list of interface by using lanscan. You can determine if an interface has an IP address by doing

ifconfig lan

If you get ``no such interface'', you do not have an IP address configured.)

To get rid of the IP address permanently, modify /etc/rc.config.d/netconf and remove the entry corresponding to the interface. Make sure that all the fields are removed. An example is shown below:

IP_ADDRESS[1]=192.13.105.166
SUBNET_MASK[1]=255.255.255.0
INTERFACE_NAME[1]=lan1
BROADCAST_ADDRESS[1]=192.13.105.255
INTERFACE_STATE[1]=up

You will need to get rid of all of these.

At the next reboot, you will no longer have an IP address configured on the interface.

(The above case is the most straightforward. I have not explained how to take care of logical interfaces or IPv6. Let me know if you need information on those.)

Thanks.

Ajit
HP Gigabit Ethernet

Re: How to configure LAN card for no IP address.?

Steven E. Protter — Wed, 05 Mar 2003 05:35:46 GMT

if its lan0 take out or comment out all references to lan0 in /etc/rc.config.d/netconf

ifconfig lan0 down

You're done.

SEP

Re: How to configure LAN card for no IP address.?

pap — Wed, 05 Mar 2003 15:47:17 GMT

Hi Ajit,
Thanks for detailed information and thanks for your time.

I have removed all the IPs associated with this lan card, however nothing is seen when I run ethereal. I mean to say, what name I should put for INTERFAC when I run ethereal?

I do not know what is the problem? I can not see any traffic on this lan card. If I connect the same network cable to my laptop and run the ethereal, I can see lots of traffic.

Please help.

Thanks,

-pap

Re: How to configure LAN card for no IP address.?

pap — Wed, 05 Mar 2003 15:47:45 GMT

Hi Ajit,
Thanks for detailed information and thanks for your time.

I have removed all the IPs associated with this lan card, however nothing is seen when I run ethereal. I mean to say, what name I should put for INTERFAC when I run ethereal?
I put LAN1.

I do not know what is the problem? I can not see any traffic on this lan card. If I connect the same network cable to my laptop and run the ethereal, I can see lots of traffic.

Please help.

Thanks,

-pap

Re: How to configure LAN card for no IP address.?

rick jones — Wed, 05 Mar 2003 23:18:28 GMT

ethereal uses libpcap.

libpcap determines the PPA of the interface to which it should attach by mapping an interface name to a PPA.

perhaps that mapping only "works" when the interface is plumbed?

i'd drop back a couple yards and get the latest libpcap and tcpudmp from http://www.tcpdump.org/ compile those up, and run them against the interface - I would _guess_ that if the interface is unplumbed, that the mapping should "fail" - what I cannot recall is what libpcap does as a fall back, if anything.

next, if you don't get an error message (btw, I suggest a verbose tusc'ing of tcpdump to see the system calls) then run linkloop to make sure that some traffic is sent through the interface. see if tcpdump sees that traffic.

Re: How to configure LAN card for no IP address.?

Ajit Natarajan — Wed, 05 Mar 2003 23:45:33 GMT

I looked at the source of ethereal-0.9.9 downloaded from http://www.ethereal.com.

In file tethereal.c, Ethereal uses pcap_open_live to get access to the interface. The interface is specified with the -i option.

Next, I looked at the libpcap source (libpcap-0.7.1 downloaded from http://www.tcpdump.org).

pcap_open_live for HP-UX is defined in pcap-dlpi.c. pcap_open_live opens /dev/dlpi and attaches to the interface. It then enables promiscuous mode. Hence, plumbing is not required.

You may want to try the following:

1. Run the program as root.
2. Run lanscan and ensure that the major number reported for the interface is 119. If not, let us know.
3. Try the following for your -i option:
(a) -i lan where is the PPA.
(b) -i
(c) -i /dev/lan

Let us know the results of your experiments.

Thanks.

Ajit
HP Gigabit Ethernet

Re: How to configure LAN card for no IP address.?

Sridhar Bhaskarla — Wed, 05 Mar 2003 23:59:12 GMT

Hi Pap,

You need to have an interface with an IP address to work with ethereal.

No need to experiment too much on it. Much of it I already did.

Just run ethereal. In the GUI, do the following

Capture -> Start

In the Capture preferences window select the interface from the drop down list. If no interfaces are configured on the box, it won't show anything. So, if you intend to capture packets on a subnet, you need have a working interface with an IP configure in that subnet.

You can use the same filtering mechanisms as of tcmdump to filter capturing of data.

-Sri

Re: How to configure LAN card for no IP address.?

rick jones — Thu, 06 Mar 2003 00:01:10 GMT

fwiw, I have now successfully seen the linkloop message being sent on an unplumbed gigbit (gelan) interface on 11.11, so the libpcap ppa mapping stuff does not care about interfaces being plumbed.

Re: How to configure LAN card for no IP address.?

James A. Donovan — Thu, 06 Mar 2003 00:54:09 GMT

After having reviewed this page:
http://www.tcpdump.org/pcap.htm

I now agree that, in theory, you should not have to set an IP address.

If you still can't capture packets, then I'd check into how the switch you're connecting to behaves if it doesn't detect an active interface on a port.

Re: How to configure LAN card for no IP address.?

Sridhar Bhaskarla — Thu, 06 Mar 2003 01:16:45 GMT

I tried unsuccessfully through *ethereal* and it won't show up the interfaces that are not plumbed.

I don't if it is a broken link between ethereal and libpcap.

-Sri

Re: How to configure LAN card for no IP address.?

rick jones — Thu, 06 Mar 2003 19:47:48 GMT

I took the liberty of asking Guy Harris, one of the ethereal folks, and this was his reply:

"Current versions of Ethereal will work with interfaces for which "pcap_lookupnet()" fails, although, of course, filters that check for broadcast IP addresses won't work, just as they won't work on tcpdump or
any other libpcap-based program (Ethereal silently uses a netmask of 0; Tethereal, like tcpdump, does so, but with a warning)."

hth

Re: How to configure LAN card for no IP address.?

pap — Fri, 07 Mar 2003 17:26:44 GMT

Hi Rick,
Thanks for your efforts.
However, i am yet to solve the problem.

Any help will be appreciated.
-pap

Re: How to configure LAN card for no IP address.?

Shannon Petry — Fri, 07 Mar 2003 17:40:09 GMT

From all I have read and seen in HP-UX you must have the nic plumbed and assigned an IP.

Perhaps you can get away with not assigning an IP, but plumbing is definate.

Shannon