HPUX DLPI binding to an SAP

[Ugly Kid Joe]

Hi people,
Im trying to get all IP traffic destinated for a local host hp 11.00 (not sniffing all packets on the wire!!) so I:
1. open dlpi
2. attach to a ppa
3. then bind it to an sap which i dont know...
Please someone can help me to fill in appropriate value for DL_BIND_REQ for SAP field (dl_sap)
and whats the difference between DL_HP_RAWDLS
and DL_CLDLS ?

i would greatly appreciate if anyone can sched some light .
Thanks.

[rick jones]

You need to use the SAP (IIRC Ethertype) assigned to IP. Prior to that, you have to make sure that the interface is not "plumbed" by the transport or it (the IP SAP, as well as ARP) will already be bound to the interface.

That presumes you want to run your own IP stack over the interface and not the system's IP stack.

As for the difference between DL_HP_RAWDLS and DL_CLDLS I suspect that would be covered by the DLPI manual(s) online at http://docs.hp.com/

If your system is connected to the rest of the network via a _switch_ then the difference in the traffic you see in normal vs promiscuous mode would be epsilon as the switch will have already filtered traffic based on destination MAC address.

So, if what you want is to see the IP traffic to/from an interface that has been ifconfiged, you would mimic what tcpdump/libpcap do - bind to some quasi-unimportant SAP and then use either DL_PROMSIC_PHYS or DL_PROMISC_SAP. Youwould then need (IIRC) to filter "yourself" based on the ethertypes - virtually all of which will be for IP and/or ARP.

In broad handwaving terms, when connected to a switch the two should be about the same. If however, the system is connected via a hub then DL_PROMISC_SAP would be what you want if you only want to see traffic that was destined to the host itself.

Depending on what you want to do with this traffic, you may be able to do something with nettl.

[Ugly Kid Joe]

Thanks a lot it was very very informative!!!