collecting tcpdump through loopback interface

[PPEC]

hi,

I am facing problems while trying to collect the TCPDump on HP-UX machine through the loopback interface lo0. Below is the problem details.

#ifconfig lo0
lo0: flags=849
inet 127.0.0.1 netmask ff000000

#tcpdump -i lo0
tcpdump: stat: /dev/lo0/: No such file or directory
#

Please help me with this issue

[rick jones]

libpcap (what tcpdump uses) uses DLPI to communicate with the interface. the loopback interface on HP-UX is "special" and contained entirely within the TCP/IP stack and so there is not really a "loopback" device with a DLPI interface.

So, you cannot use tcpdump against lo0 on HP-UX.

However, many tools (eg wireshark) can, IIRC read nettl traces, and you can use nettl against lo0.

If you wanted lo0 but not necessarily for 127.0.0.1 traffic...

Similarly, traffic to a system's own IP addresses (other than loopback) is caught by the stack before it goes to the driver for the interface with that IP address assigned. This is a performance optimization. However, you can use ndd to tell the stack to let the interface driver loop the traffic back. This then causes the traffic to go past the promiscuous mode taps and be seen via libpcap.

Getting really far out there...

I've no idea what would happen (or even if it could be done) if someone were to try to "down" lo0 and assign 127.0.0.1 to a logical interface on one of the physical interfaces in the system. I've never tried it and wouldn't suggest it ever be tried anywhere near a production network... It would probably be better to just use nettl for lo0 traffic, and file an enhancement request with the response center to get a way to do libpcap to lo0.