Ebright, Don said: > Jon, > > As far as I can determine, EFAULT is raised by the AIX BPF driver > whenever packets have been dropped since the last successful read. I > suspect that the best approach would be to add another case to the > switch after the read in pcap_read() to ignore EFAULT just as EINTR is > already ignored.
This does appear to work. I was a bit concerned that it would loop each time, producing EFAULTs, but that doesn't appear to be a problem. As a side note, it also doesn't report any dropped packets after I stop capturing, but it does EFAULT a few times. I'll just chalk this one up to AIX being as it is, or at least AIX's bpf implementation being as it is. Thanks 10e6. > Another option is to configure libpcap to use the DLPI support on AIX > as described in the libpcap README.aix. The DL_PROMISC_MULTI warning > message appears to be due to a problem in the AIX DLPI support which > has never been fixed in 4.3.3 or 5.1 AFAIK, so I believe that you will > never see any outbound packets using the DLPI driver on AIX. Inbound > seems to work OK. Yep - that does work, but unfortunately I need to see the outbound packets... long story ;-) > The problem that I described regarding BIOCSETIF disappeared after a > reboot and never returned, so I wouldn't worry about it. Doesn't seem to affect me, so I won't worry ;-) Should I send in the minor change to pcap-bpf.c? Don, thanks again - this will definitely help with my production problems here. -- -Jon "As three unwavering bands of light, we were simple and separate and beautiful. As machines, we were flabby bags of ancient plumbing and wiring, of rusty hinges and feeble springs. And our interrelationships were Byzantine." - Kurt Vonnegut, Breakfast of Champions - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
