How to configure LAN card for no IP address.?

[pap]

I am asked to configure the LAN card on HP-UX 11.0 with no IP, subnet assigned to it.

We want to do sniffer monitoring and traffic tracking by using this card.

ANy help is highly appreciated in advance.

-pap

[Ross Zubritski]

Pap,

I beleive all you need to do is use the ifconfig unplumb" command.

Regards,

RZ

[Shannon Petry]

You can not do this. By design, a NIC must be plumbed "and" given an IP address to be alive on a network and receive/send packets. Note that traffic will come to the NIC so it does not have to be on the same network or subnet.

Potential additional problems:
Switches with brains will not forward packets to this machine.

Having no IP assigned and wanting to view TCP/IP data is kind of like wanting a car with no drive train to do 120MPH.

Regards,
Shannon

[Shannon Petry]

I should clarify. You can unplumb the nic but if you do this you will not be able to see TCP/IP traffic.

[James A. Donovan]

It sounds like what you actually need to do is place the NIC into promiscuous mode. You'll have to assign it an IP address.

The tcpdump utility, when run, should automatically place the NIC of your choosing into promiscuous mode so that you can intercept all packets on that NIC's subnet.

You can download tcpdump from
here:
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcpdump-3.7.1/

[pap]

Hi,
I am using "ethereal" package to view the traffic.

Thanks,

[Sridhar Bhaskarla]

Hi Pap,

I use ethereal. You do not need to enable anything. DLPI streams subsystem will take care of it.

-Sri

[Ajit Natarajan · Accepted solution]

You do NOT need to have an IP address configured for each interface. Part of the confusion may be because SAM requires an IP address to be configured in the Networking and Communications -> Network Interface Cards configuration screen.

If you do not configure IP, you will not be able to use applications that use TCP/IP, UDP/IP, raw IP, etc., on that interface. So, for example you will not be able to use ftp, ping, telnet, and rlogin on that interface. Pure DLPI applications should work fine.

If you have the machine booted up and have an IP address configured on the interface, you can remove the IP address by doing

ifconfig lan unplumb

as root. In this command is the PPA of the interface.

(You can determine the list of interface by using lanscan. You can determine if an interface has an IP address by doing

ifconfig lan

If you get ``no such interface'', you do not have an IP address configured.)

To get rid of the IP address permanently, modify /etc/rc.config.d/netconf and remove the entry corresponding to the interface. Make sure that all the fields are removed. An example is shown below:

IP_ADDRESS[1]=192.13.105.166
SUBNET_MASK[1]=255.255.255.0
INTERFACE_NAME[1]=lan1
BROADCAST_ADDRESS[1]=192.13.105.255
INTERFACE_STATE[1]=up

You will need to get rid of all of these.

At the next reboot, you will no longer have an IP address configured on the interface.

(The above case is the most straightforward. I have not explained how to take care of logical interfaces or IPv6. Let me know if you need information on those.)

Thanks.

Ajit
HP Gigabit Ethernet

[Steven E. Protter]

if its lan0 take out or comment out all references to lan0 in /etc/rc.config.d/netconf

ifconfig lan0 down

You're done.

SEP

[pap]

Hi Ajit,
Thanks for detailed information and thanks for your time.

I have removed all the IPs associated with this lan card, however nothing is seen when I run ethereal. I mean to say, what name I should put for INTERFAC when I run ethereal?

I do not know what is the problem? I can not see any traffic on this lan card. If I connect the same network cable to my laptop and run the ethereal, I can see lots of traffic.

Please help.

Thanks,

-pap

[pap]

Hi Ajit,
Thanks for detailed information and thanks for your time.

I have removed all the IPs associated with this lan card, however nothing is seen when I run ethereal. I mean to say, what name I should put for INTERFAC when I run ethereal?
I put LAN1.

I do not know what is the problem? I can not see any traffic on this lan card. If I connect the same network cable to my laptop and run the ethereal, I can see lots of traffic.

Please help.

Thanks,

-pap

[rick jones]

ethereal uses libpcap.

libpcap determines the PPA of the interface to which it should attach by mapping an interface name to a PPA.

perhaps that mapping only "works" when the interface is plumbed?

i'd drop back a couple yards and get the latest libpcap and tcpudmp from http://www.tcpdump.org/ compile those up, and run them against the interface - I would _guess_ that if the interface is unplumbed, that the mapping should "fail" - what I cannot recall is what libpcap does as a fall back, if anything.

next, if you don't get an error message (btw, I suggest a verbose tusc'ing of tcpdump to see the system calls) then run linkloop to make sure that some traffic is sent through the interface. see if tcpdump sees that traffic.

[Ajit Natarajan]

I looked at the source of ethereal-0.9.9 downloaded from http://www.ethereal.com.

In file tethereal.c, Ethereal uses pcap_open_live to get access to the interface. The interface is specified with the -i option.

Next, I looked at the libpcap source (libpcap-0.7.1 downloaded from http://www.tcpdump.org).

pcap_open_live for HP-UX is defined in pcap-dlpi.c. pcap_open_live opens /dev/dlpi and attaches to the interface. It then enables promiscuous mode. Hence, plumbing is not required.

You may want to try the following:

1. Run the program as root.
2. Run lanscan and ensure that the major number reported for the interface is 119. If not, let us know.
3. Try the following for your -i option:
(a) -i lan where is the PPA.
(b) -i
(c) -i /dev/lan

Let us know the results of your experiments.

Thanks.

Ajit
HP Gigabit Ethernet

[Sridhar Bhaskarla]

Hi Pap,

You need to have an interface with an IP address to work with ethereal.

No need to experiment too much on it. Much of it I already did.

Just run ethereal. In the GUI, do the following

Capture -> Start

In the Capture preferences window select the interface from the drop down list. If no interfaces are configured on the box, it won't show anything. So, if you intend to capture packets on a subnet, you need have a working interface with an IP configure in that subnet.

You can use the same filtering mechanisms as of tcmdump to filter capturing of data.

-Sri

[rick jones]

fwiw, I have now successfully seen the linkloop message being sent on an unplumbed gigbit (gelan) interface on 11.11, so the libpcap ppa mapping stuff does not care about interfaces being plumbed.

[James A. Donovan]

After having reviewed this page:
http://www.tcpdump.org/pcap.htm

I now agree that, in theory, you should not have to set an IP address.

If you still can't capture packets, then I'd check into how the switch you're connecting to behaves if it doesn't detect an active interface on a port.

[Sridhar Bhaskarla]

I tried unsuccessfully through *ethereal* and it won't show up the interfaces that are not plumbed.

I don't if it is a broken link between ethereal and libpcap.

-Sri

[rick jones]

I took the liberty of asking Guy Harris, one of the ethereal folks, and this was his reply:

"Current versions of Ethereal will work with interfaces for which "pcap_lookupnet()" fails, although, of course, filters that check for broadcast IP addresses won't work, just as they won't work on tcpdump or
any other libpcap-based program (Ethereal silently uses a netmask of 0; Tethereal, like tcpdump, does so, but with a warning)."

hth

[pap]

Hi Rick,
Thanks for your efforts.
However, i am yet to solve the problem.

Any help will be appreciated.
-pap

[Shannon Petry]

From all I have read and seen in HP-UX you must have the nic plumbed and assigned an IP.

Perhaps you can get away with not assigning an IP, but plumbing is definate.

Shannon

[Sridhar Bhaskarla]

Hi Pap,

I use ethereal and I do believe that this forums is for sharing others experiences also.

So can I know what exactly is your problem is and why you are insisting for an interface without an IP?.

Did you really try to run ethereal?.
You can toggle an interface for promiscous mode through ethereal. But you cannot select an interface through *ethereal* if it is not plumbed. I am not talking about libpcap here.

-Sri

[rick jones]

Pap - at this point I would suggest joining the ethereal mailing list and initiating a discussion there. That will have the distinct advantage of communicating directly with the ethereal maintainers.

Then once you have the issue resolved, come back here with the answer and maybe the next unfortunate will not have to go through the same chain of events.

[pap]

HI All,
I really love this forum and people in this forum. I will definately put this question in ethereal discussion mailing list and see how it goes. I am sure there will be definately distinctive experience with that..:...as Rick suggested.

Once again thanks for your efforts in responding me.

One thing is sure, I have two interfaces in the machine and the other one is assigned with a IP which is workable, I can easily capture the traffic on this interface through ethereal however, unsuccessful in capturing traffic through other interface which is under consideration.

Thanks,
-pap

[Sridhar Bhaskarla]

Hi Pap,

I wish you good luck in ethreal forums.

Ethreal by default will not show the interfaces that are not plumbed which I learnt.

I went ahead and did some more testing. I used one of my serviceguarded machines, unplumbed the standby interface (ifconfig lan7 unplumb) and then invoked ethreal. It didn't show lan7.

Then I invoked ethereal with -i option like

/opt/ethereal/bin/ethereal -i lan7

(lan7 is my standby unplumbed interface)

And I could capture the packets on that interface.

This makes me to think if invoked without any options, ethreal bluntly displays the plumbed interfaces and then uses libpcap on the selected interface to capture the data through dlpi. So, you can force ethereal to select an interface with -i option.

-Sri

[pap]

Dear HP Gurus :

Unfortunately I could not resolve the problem of running ethereal on my Stratus box running HP-UX 11.0. I did lots of research and used Ethereal forums too. Then I gave it up.
I used to manage another HP9000 Server for this work and loaded Ethereal on it.

The exciting thing is that , without any vonfiguration changes on Machine or interface, it went fine. HP is great..!!
Thanks for the support from you all the time. Appreciate your help in this regard. FInally My job has been done...:)).

-pap