On Mon, Feb 12, 2001 at 09:42:49AM +0100, Torsten Landschoff wrote:
> On Mon, Feb 12, 2001 at 05:35:41PM +0900, [EMAIL PROTECTED] wrote:
> > >pulsar:~# tcpdump host ip6-localhost
> > >tcpdump: listening on eth0
> > >[...]
> >
> > are there any difference, if you use "127.0.0.1" or "192.168.2.3"?
>
> *arg* That question is so obvious, I do not know why I did not think of
> it.
>
> pulsar:/home/torsten/packages/tcpdump/libpcap-0.6.1# tcpdump host 127.0.0.1
> tcpdump: listening on eth0
> [...]
Note that
host localhost
might not be the same as
host 127.0.0.1
in an IPv6-enabled version of libpcap, if "pcap_nametoaddrinfo()"
returns both IPv4 and IPv6 addresses. You might want to see what
happens inside "gen_scode()" in the block starting at about line 2835 -
that's the code that starts with
memset(&mask128, 0xff, sizeof(mask128));
res0 = res = pcap_nametoaddrinfo(name);
and then generates checks against all the addresses in the list starting
with "res0".
Your "/etc/hosts" appears to have only an IPv4 entry for "localhost:
> /etc/hosts has the following relevant entries:
>
> 127.0.0.1 localhost
> 192.168.2.2 blackhole.galaxy blackhole
> 192.168.2.3 pulsar.galaxy pulsar
> ::1 ip6-localhost ip6-loopback
but perhaps it's finding both an IPv4 and an IPv6 entry via DNS rather
than finding the addresses in "/etc/hosts".
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
