tcpdump fails -- recv_ack: info unexpected primitive ack 0x...

[Dan Copeland]

It hasn't worked in a while (I assume some patch broke it). I had some time to try and fix it so I downloaded the latest tcpdump and libpcap but still getting the same error.

I have other HP servers w/ the identical ignite image and identical h/w that are working fine.

any thoughts?

tia,
Dan

[Stephen Keane]

Did you install libpcap BEFORE tcpdump, if not try it that way around?

Also make sure another instance of tcpdump isn't running at the same time.

[Denver Osborn]

Have you tried to figure out what's different between the working systems and this one?

How about comparing patches?

# swlist -l product PH[CKNS][OLES]\*

Also make sure all patches are in a configured state...

# swlist -l fileset -a state |grep -E 'installed|corrupt|transient'

If none of that helps find and resolve the problem, if you have tusc on the box... use it to troubleshoot the tcpdump failure.

# tusc -fnvo /tmp/tcpdump.tusc your_tcpdump_cmd_syntax

hope this helps
-denver

[rick jones]

You are root when trying to run tcpdump yes?

There is nothing else with the interface in promiscuous mode is there?

[Dan Copeland]

some answers to the questions:

libpcap installed first
no other tcpdump running
patches are the same and configured
running it as root
not sure how to check for any thing else in promiscuous...

tusc showed this:
tcpdump: /usr/lib/dld.sl: Unresolved symbol: pcap_datalink_val_to_name (code)

[rick jones · Accepted solution]

hmm, that last one may suggest an incomplete libpcap? perhaps linking against a pcap other than the one you expect?

if all else fails, you could install the HP Internet Express version of tcpdump

[Dan Copeland]

the internet express version of tcpdump worked -- thanks Rick