Bug 342

Summary: tcpdump doesn't work with recent 2.1 kernels
Product: [Retired] Red Hat Linux Reporter: Marc MERLIN <marc_soft>
Component: tcpdumpAssignee: Harald Hoyer <harald>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.2   
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 1998-12-09 17:22:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Marc MERLIN 1998-12-08 07:53:40 UTC
moremagic:~# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:40:05:26:A8:69
          inet addr:  Bcast:
          RX packets:261371 errors:0 dropped:0 overruns:0
          TX packets:491259 errors:0 dropped:0 overruns:0
          Interrupt:10 Base address:0x340

moremagic:~# LC_ALL=C tcpdump -i eth0
tcpdump: socket: Socket type not supported
moremagic:~# uname -a
Linux moremagic.magic.metawire.com 2.1.131 #20 jeu dic 3
22:20:18 PST 1998 i586 unknown

I can't say if how recently it's been broken. As far as I
can remember, I never got it to work with a 2.1.x kernel

Comment 1 Aleksey Nogin 1998-12-09 00:50:59 UTC
You need to enable packet protocol in the kernel.

From the Configure.help:

  The Packet protocol is used by applications which communicate
  directly with network devices without an intermediate network
  protocol implemented in the kernel, e.g. tcpdump. If you want them
  to work, choose Y. This driver is also available as a module called
  af_packet.o ( = code which can be inserted in and removed from the
  running kernel whenever you want). If you want to compile it as a
  module, say M here and read Documentation/modules.txt. If unsure,
  say Y.

Comment 2 Marc MERLIN 1998-12-09 06:25:59 UTC
Thanks for the pointer. I had compiled this in, but as a module and
when I checked again after your answer I realized that modprobe
couldn't load the module automatically.
What's a bit annoying is that "can't locate module net-pf-17" is only
logged at the info level (it used to be at least warning), and thus
didn't make it to my console :-(
Adding "alias net-pf-17 af_packet" to /etc/conf.module solved
the problem. Maybe it'd be a nice idea to have a default file with
a few default entries.

Anyway the problem was mine, sorry for this bogus report and for
wasting your time. You can close this ticket

Comment 3 Jeff Johnson 1998-12-09 17:22:59 UTC