Bug 557728

Summary: packet capture not work if 32bit userspace on 64bit kernel
Product: Red Hat Enterprise Linux 5 Reporter: Yury Stankevich <urykhy>
Component: tcpdumpAssignee: Michal Sekletar <msekleta>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: low Docs Contact:
Priority: low    
Version: 5.4   
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-10-06 13:07:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
patch to allow using 32bit pcap on 64bit kernel
none
fix -m32 build (need to build 32bit libpcap.so on 64bit host)
none
patch to allow using 32bit pcap on 64bit kernel none

Description Yury Stankevich 2010-01-22 11:58:33 UTC 
Created attachment 386129 [details]
patch to allow using 32bit pcap on 64bit kernel

Description of problem:

packet capturing not work if 32bit userspace application (tcpdump) running
on 64bit kernel. (64bit tcpdump work well)

Version-Release number of selected component (if applicable):
tcpdump-3.9.4-14
libpcap-1.0.0

How reproducible:

32 bit :
# tcpdump -i any icmp -s 0
19:22:40.1264160270 IP0 truncated-ip 0
19:22:40.1264160270 IP0 truncated-ip 0
19:22:40.1264160272 IP13 truncated-ip 0

64 bit:
# tcpdump -i any icmp -s 0
14:39:36.232144 IP xxx.com > yyy.com: ICMP echo request, id 55161, seq 2, length 64
14:39:36.232164 IP yyy.com > xxx.com: ICMP echo reply, id 55161, seq 2, length 64

i expect that 32bit tcpdump should give the same results as 64 bit one.


Additional info:

yes, i use new version of libpcap (1.0.0) instead of distributed one ( 0.9.4 in tcpdump-3.9.4-15.el5.src.rpm as i can see in ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/ ). 

If i understand it right - bug is caused by the fact that kernel (2.6.18-164.6.1.el5) is not support TPACKET_V2 interface ( as http://article.gmane.org/gmane.network.tcpdump.devel/3170 ). So i make a simple patch to address this issue in userspace only, and i think it can be helpful for you too.
Comment 1 Yury Stankevich 2010-01-22 11:59:49 UTC 
Created attachment 386131 [details]
fix -m32 build (need to build 32bit libpcap.so on 64bit host)
Comment 2 Yury Stankevich 2010-01-22 12:04:41 UTC 
Created attachment 386133 [details]
patch to allow using 32bit pcap on 64bit kernel
Comment 3 Michal Sekletar 2011-10-06 13:07:46 UTC 
Hello,

thank you for the patch, but libpcap is working properly in version which is shipped in RHEL-5 and in this phase of RHEL-5 release cycle there is no intention to update libpcap to newer version, so I'll close this bug with resolution WONTFIX.
If you have any further questions or comments related to this issue please feel free to write me an email.