Bug 39407 - libpcap silently ignores pcap_lookupnet() calls
Summary: libpcap silently ignores pcap_lookupnet() calls
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: tcpdump   
(Show other bugs)
Version: 7.0
Hardware: i386 Linux
Target Milestone: ---
Assignee: Harald Hoyer
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2001-05-07 15:44 UTC by Need Real Name
Modified: 2008-05-01 15:38 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2001-05-08 15:58:44 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description Need Real Name 2001-05-07 15:44:32 UTC
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)

Description of problem:
Sometime in the last year or so, somebody replaced the
pcap_lookupnet() call in libpcap with a function that silently returns 
without error, but does nothing. This despite the fact that the man page 
(man pcap) still regards it as a valid function call.

How reproducible:

Steps to Reproduce:
1. Try and compile and run a program that uses pcap_lookupnet()
2. Watch it return invalid results.
3. Better yet, look at the source code: libpcap-0.4/inet.c, line 170

Additional info:

This appears in a RedHat patch, so it's not in the standard libpcap. The 
appropriate code is commented out with "All this function was a crap. --
ANK", which, while possibly entertaining, is not very professional. Either 
the appropriate code should be restored, or a more useful reason given why 
it was deleted (in which case the man page should be updated to reflect 
that this function no longer works).

Comment 1 Harald Hoyer 2001-05-07 15:52:24 UTC
do you know why this was done?

Comment 2 Harald Hoyer 2001-05-07 15:53:36 UTC
sorry  murrayr@massdor.com, I meant jbj@redhat.com ...

Comment 3 Jeff Johnson 2001-05-07 16:13:06 UTC
Ask ANK. I just packaged ANK's changes, that was the Right Thing To Do for
linux at the time. Now that ANK's changes have been (mostly) merged into the
tcpdump.org base, and tcpdump is being maintained, other changes are probably

Aside: IMHO tying a network sniffer into lookups that can caues Yet More Traffic
is kinda crazy, so I also happen to agree with ANK. There are *lots* of ways
to get tricked when the network lookup lies to you ... <shrug>

Comment 4 Need Real Name 2001-05-07 16:51:53 UTC
Point taken. But it would be good if:
a) The function was removed from the man page (or, better, left there but noted 
as disabled in this implementation)
b) The function returned an error instead of zero. This way we'd know that it 
wasn't working, at least. I believe pcap_lookupdev() does the same thing, but I 
haven't looked.

Comment 5 Need Real Name 2001-05-08 15:09:53 UTC
Accepted under protest. I believe that if you're going to summarily delete a 
function from an API, then you have a responsibility to delete references to it 
from the documentation and either delete it from the library or make it return 
with an error. Having it return silently just makes it annoying.
I've wasted three days of my time and a year's worth of reduced-usefulness data 
over this issue.
This vindicates my decision to return to Debian. Red Hat seems to have lost the 

Comment 6 Harald Hoyer 2001-05-08 15:58:39 UTC
OK ;-), I will give it a shot tomorrow... calm down.

Comment 7 Harald Hoyer 2001-07-19 13:04:06 UTC
try libpcap-0.6.2

Note You need to log in before you can comment on or make changes to this bug.