Source IP 0.0.0.0

[Rumen Ginev]

Hi,

On a HP-UX 11.11 A500 box I compiled few programs and found the following effect:

- ipop3d, imap3d, squid : In the log file clients' IP addresses are always 0.0.0.0

- tcpdump: captures packets if it is used without output filter. For example:
#tcpdump -i lan0 -n
Captures everything on the interface
#tcpdump -i lan0 -n host 1.2.3.4
Returns nothing when I "ping" the listening host from 1.2.3.4
I think the reason is the same as with ipop3d and squid: for tcpdump every connection is form IP 0.0.0.0

The compiler is gcc-3.0.2, 64 bit downloaded from HP devresource site.

Any ideas?

Thanks in advance,
Rumen

[harry d brown jr]

Rumen,

Are you using this version of tcpdump?

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcpdump-3.6.2/

live free or die
harry

[Rumen Ginev]

Harry,

Yes, I use the same version of tcpdump.

Rumen

[harry d brown jr]

Rumen,

You installed libpcap-0.6.2-sd-11.00.depot correct?

I get this, using tcpdump -i lan0 -n host 141.123.226.49:

tcpdump: listening on lan0
10:58:19.956238 141.123.226.49 > 141.123.226.41: icmp: echo request (DF)
10:58:19.958688 arp who-has 141.123.226.49 (ff:ff:ff:ff:ff:ff) tell 141.123.226.41
10:58:19.958982 arp reply 141.123.226.49 is-at 0:30:6e:1b:3c:3e
10:58:19.959091 141.123.226.41 > 141.123.226.49: icmp: echo reply (DF)
10:58:20.965482 141.123.226.49 > 141.123.226.41: icmp: echo request (DF)
10:58:20.965665 141.123.226.41 > 141.123.226.49: icmp: echo reply (DF)
10:58:21.975436 141.123.226.49 > 141.123.226.41: icmp: echo request (DF)
10:58:21.975637 141.123.226.41 > 141.123.226.49: icmp: echo reply (DF)
10:59:43.759217 arp who-has 141.123.236.157 (ff:ff:ff:ff:ff:ff) tell 141.123.226.49
......


live free or die
harry

[Steven Sim Kok Leong]

Hi,

Does executing netstat -f inet also shows you source IP addresses of 0.0.0.0?

# netstat -f inet

Hope this helps. Regards.

Steven Sim Kok Leong

[Rumen Ginev]

Hi,

Harry I have not installed libpcap and tcpdump from a depot. I compiled them from source code.

Steven, netstat -f inet returns correct IP addresses.

Rumen

[harry d brown jr]

Rumen,

That is probably your issue then, I loaded the DEPOTs from HP (utah) and ran those. it's probably an issue with 32 versus 64bit. I guess you could debug it, but is it worth it?

live free or die
harry

[Rumen Ginev]

Harry,

You are absolutely right!
I have 32-bit versions of these programs and they work fine, but I was just curious.
And I wanted to compare the performance of 32-bit and 64-bit squid.

Obviously nobody has experienced similar problems on HP-UX11.11 with 64-bit applications.:-(

Thanks,
Rumen

[harry d brown jr]

Rumen,

I've been contemplating, should I build it or install it from a depot, and so far the depot's look better, but I'm on your side, I also want to know what can be "ported". If I have any success, I'll let you know.

live free or die
harry