topic Re: tcpdump error in Operating System - HP-UX

tcpdump error

Mark Greene_1 — Thu, 01 May 2003 18:04:54 GMT

I downloaded tcpdump and the libpacp depots and installed them today. I am getting the following error when I run tcpdump:

# /usr/local/sbin/tcpdump -a -d -i lan0 -vvv -w /var/adm/syslog/tcpdump.log -x -X tcp port 20 tcp port 21
/usr/lib/dld.sl: Unresolved symbol: pcap_error (code) from /usr/local/lib/libpcap.sl
Abort(coredump)
#
# ls -l
total 5504
-rw------- 1 root sys 1168988 May 1 13:52 core
-rw-r----- 1 mgreene general 419840 May 1 10:18 libpcap-0.7.2-sd-11.00.depot
-rw-r----- 1 mgreene general 737280 May 1 10:18 tcpdump-3.7.1-sd-11.00.depot
-rw-r----- 1 mgreene general 491520 May 1 13:45 tcpdump-3.7.2-sd-11.00.depot
# file core
core: core file from 'tcpdump' - received SIGABRT

This is on an rp5400 running HP11.00 patched through the Dec 2002 release and the March 2003 security patches.

I did a search on HP's website for this error, and got references to these two patches, which I already have loaded:

PHNE_21390
PHNE_26771

Has anyone seen this before, or have an idea of where I go next to get tcpdump running?

TIA,
mark

Re: tcpdump error

S.K. Chan — Thu, 01 May 2003 19:27:17 GMT

Not sure about this but you may want to try version 0.5.2 (which I have on one of my machine). Get it from this HP site .. (it actually brings you to HPUX porting center).
http://h21007.www2.hp.com/dspp/tech/tech_TechDocumentDetailPage_IDX/1,1701,4682,00.html#12

Re: tcpdump error

Mark Greene_1 — Thu, 01 May 2003 20:28:58 GMT

I uninstalled the 0.7.2 and installed the 0.5.2 and ran tcpdump, and it still errored:

/usr/local/sbin/tcpdump -a -d -i lan0 -vvv -w /var/adm/syslog/tcpdump.log -x -X tcp port 20 tcp port 21
/usr/lib/dld.sl: Can't open shared library: /usr/local/lib/libpcap.sl
/usr/lib/dld.sl: No such file or directory
Abort(coredump)

which, of course, indicates that I really do need the 0.7.2 version.

Thanks for the suggestion though.

Re: tcpdump error

Mark Greene_1 — Thu, 01 May 2003 20:29:35 GMT

Re: tcpdump error

T G Manikandan — Fri, 02 May 2003 02:23:10 GMT

First check whether you have the file libpcap.sl in the machine.

If it is present then please add that directory to the SHLIB_PATH variable so that it is referenced during the execution of tcpdump.

REvert

Re: tcpdump error

Bill Douglass — Fri, 02 May 2003 02:57:29 GMT

Whar are the permissions on /usr/local/lib/libpcap.sl?

Re: tcpdump error

Mark Greene_1 — Fri, 02 May 2003 13:02:52 GMT

/usr/local/lib/libpcap.sl does not exist on the system. I'm going to unistall libpcap and tcpdump and resinstall both at the 0.7.2 versions and then send the core file to HP support for them to examine.

Re: tcpdump error

Bill Douglass — Fri, 02 May 2003 14:31:16 GMT

Also try doing a

swlist -s /path/to.libpcap.depot -l file

to get a listing of the files in your depot. See where it is installing libpcap.sl, or what name it is using.

Re: tcpdump error

rick jones — Mon, 05 May 2003 13:58:24 GMT

just to be paranoid...

you did build libpcap first, and the provide a link for a "libpcap" peer directory to the tcpdump director when you built didn't you?

That, and/or when you installed a binary libpcap it did put a .sl into /usr/local/lib and a chatr on the tcpudmp executable lists /usr/local/lib/libpcap... as a dependency?

Re: tcpdump error

Mark Greene_1 — Mon, 05 May 2003 17:40:39 GMT

Rick,

I did not build the depots, I downloaded them pre-built, (from here: http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/alpha.html )which I suspect is the problem. We get our OS support via our application vendor, and I have put in a request with them to go to HP software support for this. I'll post an update once I have one.

mark

Re: tcpdump error

rick jones — Mon, 05 May 2003 21:49:40 GMT

tsk tsk tsk, non-HP software support :) however, in this specific instance, i'm not certain the extent to which official HP channels would provide support - tcpdump is not a supported product from HP.

I just downloaded both depots and swinstalled them on an HP-UX 11.11 system. For some reason the tcpdump depot installs tcpdump in /usr/local/sbin even though it is not a static-bound executable... The chatr shows it does seem to be looking for libpcap in the right place:

sweb142: chatr /usr/local/sbin/tcpdump
/usr/local/sbin/tcpdump:
shared executable
shared library dynamic path search:
SHLIB_PATH enabled first
embedded path disabled second Not Defined
shared library list:
dynamic /usr/local/lib/libpcap.sl
dynamic /usr/lib/libnsl.1
dynamic /usr/lib/libc.2
shared library binding:
deferred

the binary appears to run just fine. I'd try an 11.0 system, but I don't actually have one at my disposal at the moment.