Bug 105964

Summary: Libpcap pcap_next( ) returns wrong first 6 bytes
Product: [Fedora] Fedora Reporter: KJB <k.j.b>
Component: tcpdumpAssignee: Harald Hoyer <harald>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhide   
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2003-10-13 10:15:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Example program to illustrate problem none

Description KJB 2003-09-30 00:56:25 UTC 
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030703

Description of problem:
When using the compiled program pcap_example (pcap_example.c is attached),
pcap_next() will return a pointer with random data in
the first 6 bytes.  

Note: The random data are not true MAC addresses, they are garbarge as far a I
can tell.

The program works flawlessly on OpenBSD 3.3, which leads me to believe that this
is a Linux issue.

Version-Release number of selected component (if applicable):
libpcap 0.7.2

How reproducible:
Always

Steps to Reproduce:
1. Compile libpcap 0.7.2 or libpcap-2003.09.28

2. Compile pcap_example.c 
(gcc pcap_example.c -o pcap_example /usr/lib/libpcap.a)

3. Execute pcap_example (./pcap_example )

4. Generate some network traffic. (i.e. surf the web,
ping something, etc...)

5. pcap_example will return "random" data for the
next six bytes,
and not the Layer 2 ethernet destination MAC address.

Actual Results:  # ./pcap_example.bin

Listening...
        Captured a packet.
        Layer 2 ethernet frame Destination: 7a:9:0:30:7a:9
        Layer 2 ethernet frame Source: 0:1:3:1f:ad:4f
Exiting
#



Expected Results:  # ./pcap_example.bin

Listening...
        Captured a packet.
        Layer 2 ethernet frame Destination: 0:6:25:b9:ce:5b
        Layer 2 ethernet frame Source: 0:1:3:1f:ad:4f
Exiting
#

Additional info:

Tried with libpcap-2003.09.28.tar.gz as well, with the same results.

This could be a flaw in my understanding of how libpcap works, but it doesn't
explain why it works perfectly on OpenBSD.
Comment 1 KJB 2003-09-30 00:58:42 UTC 
Created attachment 94844 [details]
Example program to illustrate problem