tcpdump mailing list archives

Re: Unexpected primitive ack DL_UNITDATA_IND


From: Rick Jones <rick.jones2 () hp com>
Date: Wed, 09 Jun 2004 13:58:17 -0700

Guy Harris wrote:

On Jun 9, 2004, at 1:27 PM, Rick Jones wrote:

Does it always happen or just sometimes? A DL_UNITDATA_IND is basically saying "Hi there, here is a packet" in DLPI speak. It looks like the stream is sending one of those up to the application when libpcap isn't expecting it.


In fact, it's sending one up when, presumably, libpcap is waiting for a DL_INFO_ACK in response to a DL_INFO_REQ it sent downstream to determine either the DLPI provider style or the link-layer type.

I don't have the DLPI spec handy; currently, pcap-dlpi.c makes two info requests, one just after opening the device and one after binding to the PPA (but *before* setting DLIOCRAW or pushing "bufmod") - can a DLPI provider cough up packets at that point?

On the surface I wouldn't think so - simply attaching to a PPA I don't think means traffic could arrive - however, if one has attached, and then binds to a SAP, then traffic could indeed start arriving. (Il-informed guesstimation, and hopefully I'm recalling the correct distinction between attach and bind)

Although I might wonder about something like a link-down or other housekeeping message that the stream might cough-up - although I would have expected those to be a PROTO or PCPROTO (if I'm recalling the mnemonics correctly).

rick jones
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.


Current thread: