tcpdump problem - Device busy

[Konstantin Sokolov]

I have problem with tcpdump on hp-ux B.11.11 U 9000/800:

tcpdump -i lan1
tcpdump: recv_ack: bind: UNIX error - Device busy

I thing that something/someone uses promiscuous mode on this interface.
How can I get know what process set lan1 to promiscuous mode and how can I start tcpdump on this interface?
Thank you

[Steven E. Protter]

Shalom,

lanscan

make sure the device is actually present and accounted for.

tcpdump sets the device to promiscuous mode (racy term) at startup. If tcpdump can not, either the device is not working right or tcpdump is not working.

What is your source for tcpdump? You may wish to pull a new version from:
http://software.hp.com
Search for Internet Express
Then find the listing for tcpdump
Download
swinstall the depot

SEP

[Konstantin Sokolov]

Thank you.
But lanscan shows that everything is fine with this interface:
lanscan
Hardware Station Crd Hdw Net-Interface NM MAC HP-DLPI DLPI
Path Address In# State NamePPA ID Type Support Mjr#
0/1/2/0 0x0017A451A3F8 0 UP lan0 snap0 1 ETHER Yes 119
0/1/2/1 0x0017A451A3F9 1 UP lan1 snap1 2 ETHER Yes 119
0/5/2/0 0x0017A476ED62 3 UP lan3 snap3 3 ETHER Yes 119
0/5/1/0 0x0017A4763C81 2 UP lan2 snap2 4 ETHER Yes 119

And tcpdump works for lan3 on this server. I donâ t know what to do elseâ ¦

[smatador]

Hi,

Look at this thread maybe it can help you
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=753211
Maybe if you have OVO or others soft like OVO, perhaps you have to do
http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=941222

[Laurent Menase]

You have probably indeed an other process using promisc on that interface
There is a tool developped by 3rd level of support named lanshow available through hp support which can report which process is using promisc mode.

Else with lsof you can get what process had /dev/dlpi opened.

[Konstantin Sokolov]

Thank you everybody! The problem was in OVO agents probably. But very strange situation: opcagt command shows that agents are stoped, but tcpdump starts working after opcagt â kill command. Never the less thank you for help.

[Konstantin Sokolov]

Thanks!
The problem was in OVO agents probably. But very strange situation: opcagt command shows that agents are stoped, but tcpdump starts working after opcagt -kill command.