tcpdump: lan0:1 bad unit number

[Rainer von Bongartz]

Im trying to use tcpdump -i lan0 and get the error messages:
tcpdump: lan0:1 bad unit number

lanscan shows the correct information

Hardware Station Crd Hdw Net-Interface NM MAC HP-DLPI DLPI
Path Address In# State NamePPA ID Type Support Mjr#
10/4/16 0x080009DC81C7 0 UP lan0 snap0 2 ETHER Yes 119

Extended Station LLC Encapsulation
Address Methods
0x080009DC81C7 IEEE HPEXTIEEE SNAP ETHER NOVELL

Driver Specific Information
btlan1

Any ideas why tcpdump is complaining about lan0

[Bill McNAMARA_1]

Try it without the -i, according to the man http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/tcpdump-3.6.2/man.html
it will select lan0 in any case.. it may be something as stupid as leaving out the /dev/

Make sure in anycase ioscan -fnkClan, lanscan and ifconfig show lan0 status as good.

Later,
Bill

[Rainer von Bongartz]

Bill,

ioscan -fnkClan, lanscan and ifconfig show lan0 status as good.

tcpdump withe -i option give same error message
tcpdump: lan0:1 bad unit number

I discovered it is complaining about lan0:1
which is an ip-alias on the lan card.

Can tcpdump run on a lan card which has an alias defined ???

[rick jones]

tcpdump only works against what at the transport level are considered "physical" interfaces. that means "lan0", "lan1", "lanN" etc. an interface name of the form "lan0:1" is what the transport considers a "logical" interface.

so, you need to say "-i lan0" and if you only want to see traffic to/from the IP address associated with lan0:1, you need to use a filter expression.

there are several flavors of interface. at the transport level, we have what transport considers the "physical" interface, which is manifest by a single DLPI instance from a driver. then there are "logical" interfaces at the transport level (ie IP) which exist solely as datastructures in IP and funnel through the same single DLPI isntance as the physical interface.

now if we switch to the data-link/driver level, we have physical interfaces - ie NICs or individual ports on a NIC, and we have virtual interfaces - ie an APA trunk, or perhaps in the future VLAN interfaces. a virtual interface a tthe data-link layer is treated by the transport as a "physical" interface in transport-level terminology.

soooo, we can have logical transport interfaces sharing what the transport considers a single physical link that is really a virtual interface exported by the data link layer which is composed of several physical NIC's bound together in a trunk. clear isn't it?-)

(yes, one can tcpdump an APA trunk :)