tcpdump error

[Mark Greene_1]

I downloaded tcpdump and the libpacp depots and installed them today. I am getting the following error when I run tcpdump:

# /usr/local/sbin/tcpdump -a -d -i lan0 -vvv -w /var/adm/syslog/tcpdump.log -x -X tcp port 20 tcp port 21
/usr/lib/dld.sl: Unresolved symbol: pcap_error (code) from /usr/local/lib/libpcap.sl
Abort(coredump)
#
# ls -l
total 5504
-rw------- 1 root sys 1168988 May 1 13:52 core
-rw-r----- 1 mgreene general 419840 May 1 10:18 libpcap-0.7.2-sd-11.00.depot
-rw-r----- 1 mgreene general 737280 May 1 10:18 tcpdump-3.7.1-sd-11.00.depot
-rw-r----- 1 mgreene general 491520 May 1 13:45 tcpdump-3.7.2-sd-11.00.depot
# file core
core: core file from 'tcpdump' - received SIGABRT

This is on an rp5400 running HP11.00 patched through the Dec 2002 release and the March 2003 security patches.

I did a search on HP's website for this error, and got references to these two patches, which I already have loaded:

PHNE_21390
PHNE_26771

Has anyone seen this before, or have an idea of where I go next to get tcpdump running?

TIA,
mark

[S.K. Chan]

Not sure about this but you may want to try version 0.5.2 (which I have on one of my machine). Get it from this HP site .. (it actually brings you to HPUX porting center).
http://h21007.www2.hp.com/dspp/tech/tech_TechDocumentDetailPage_IDX/1,1701,4682,00.html#12

[Mark Greene_1]

I uninstalled the 0.7.2 and installed the 0.5.2 and ran tcpdump, and it still errored:

/usr/local/sbin/tcpdump -a -d -i lan0 -vvv -w /var/adm/syslog/tcpdump.log -x -X tcp port 20 tcp port 21
/usr/lib/dld.sl: Can't open shared library: /usr/local/lib/libpcap.sl
/usr/lib/dld.sl: No such file or directory
Abort(coredump)


which, of course, indicates that I really do need the 0.7.2 version.

Thanks for the suggestion though.

[Mark Greene_1]

I uninstalled the 0.7.2 and installed the 0.5.2 and ran tcpdump, and it still errored:

/usr/local/sbin/tcpdump -a -d -i lan0 -vvv -w /var/adm/syslog/tcpdump.log -x -X tcp port 20 tcp port 21
/usr/lib/dld.sl: Can't open shared library: /usr/local/lib/libpcap.sl
/usr/lib/dld.sl: No such file or directory
Abort(coredump)


which, of course, indicates that I really do need the 0.7.2 version.

Thanks for the suggestion though.

[T G Manikandan]

First check whether you have the file libpcap.sl in the machine.

If it is present then please add that directory to the SHLIB_PATH variable so that it is referenced during the execution of tcpdump.


REvert

[Bill Douglass]

Whar are the permissions on /usr/local/lib/libpcap.sl?

[Mark Greene_1]

/usr/local/lib/libpcap.sl does not exist on the system. I'm going to unistall libpcap and tcpdump and resinstall both at the 0.7.2 versions and then send the core file to HP support for them to examine.

[Bill Douglass · Accepted solution]

Also try doing a

swlist -s /path/to.libpcap.depot -l file

to get a listing of the files in your depot. See where it is installing libpcap.sl, or what name it is using.

[rick jones]

just to be paranoid...

you did build libpcap first, and the provide a link for a "libpcap" peer directory to the tcpdump director when you built didn't you?

That, and/or when you installed a binary libpcap it did put a .sl into /usr/local/lib and a chatr on the tcpudmp executable lists /usr/local/lib/libpcap... as a dependency?

[Mark Greene_1]

Rick,

I did not build the depots, I downloaded them pre-built, (from here: http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/alpha.html )which I suspect is the problem. We get our OS support via our application vendor, and I have put in a request with them to go to HP software support for this. I'll post an update once I have one.

mark

[rick jones]

tsk tsk tsk, non-HP software support :) however, in this specific instance, i'm not certain the extent to which official HP channels would provide support - tcpdump is not a supported product from HP.

I just downloaded both depots and swinstalled them on an HP-UX 11.11 system. For some reason the tcpdump depot installs tcpdump in /usr/local/sbin even though it is not a static-bound executable... The chatr shows it does seem to be looking for libpcap in the right place:

sweb142: chatr /usr/local/sbin/tcpdump
/usr/local/sbin/tcpdump:
shared executable
shared library dynamic path search:
SHLIB_PATH enabled first
embedded path disabled second Not Defined
shared library list:
dynamic /usr/local/lib/libpcap.sl
dynamic /usr/lib/libnsl.1
dynamic /usr/lib/libc.2
shared library binding:
deferred

the binary appears to run just fine. I'd try an 11.0 system, but I don't actually have one at my disposal at the moment.