Re: AIX BPF driver load

[Guy Harris <guy () netapp com>]

On Fri, Feb 07, 2003 at 05:10:50PM +1100, Shaun wrote:
> bpf_open.... the logic used in the IBM implementation is:
>
> static inline int
> bpf_open(pcap_t *p, char *errbuf)
> {
>    int fd;
>    int n = 0;
>    char device[sizeof "/dev/bpf0000000000"];
>
> #ifdef _AIX
>    /*
>     * Load the bpf driver, if it isn't already loaded
>     */
>    if (bpf_load() == -1)
>    {
>       snprintf(errbuf, PCAP_ERRBUF_SIZE, "bpf_load: kernel load failure:
> %s",
>                device, pcap_strerror(errno));
>       return(-1);
>    }
> #endif

By the way, if you managed to reverse-engineer that, it might also be
interesting to figure out what the deal is with BIOCIMMEDIATE.  Tthe
timeout set with BIOCSRTIMEOUT doesn't seem to work right on AIX - it
appears to be ignored, and the read doesn't complete until the kernel
packet buffer is full, so you may wait forever to see packets - so we
currently, on AIX, turn on BIOCIMMEDIATE so that packets are always
delivered immediately.

(See the big comment before the code in pcap-bpf.c that turns
BIOCIMMEDIATE on.)

At last at one point I think I tried, on AIX, assuming that the timeout
was in seconds and nanoseconds rather than seconds and microseconds; as
I remember, that didn't help.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe