From Bugzilla Helper: User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Description of problem: Sometime in the last year or so, somebody replaced the pcap_lookupnet() call in libpcap with a function that silently returns without error, but does nothing. This despite the fact that the man page (man pcap) still regards it as a valid function call. How reproducible: Always Steps to Reproduce: 1. Try and compile and run a program that uses pcap_lookupnet() 2. Watch it return invalid results. 3. Better yet, look at the source code: libpcap-0.4/inet.c, line 170 Additional info: This appears in a RedHat patch, so it's not in the standard libpcap. The appropriate code is commented out with "All this function was a crap. -- ANK", which, while possibly entertaining, is not very professional. Either the appropriate code should be restored, or a more useful reason given why it was deleted (in which case the man page should be updated to reflect that this function no longer works).
do you know why this was done?
sorry murrayr, I meant jbj ...
Ask ANK. I just packaged ANK's changes, that was the Right Thing To Do for linux at the time. Now that ANK's changes have been (mostly) merged into the tcpdump.org base, and tcpdump is being maintained, other changes are probably necessary. Aside: IMHO tying a network sniffer into lookups that can caues Yet More Traffic is kinda crazy, so I also happen to agree with ANK. There are *lots* of ways to get tricked when the network lookup lies to you ... <shrug>
Point taken. But it would be good if: a) The function was removed from the man page (or, better, left there but noted as disabled in this implementation) b) The function returned an error instead of zero. This way we'd know that it wasn't working, at least. I believe pcap_lookupdev() does the same thing, but I haven't looked.
Accepted under protest. I believe that if you're going to summarily delete a function from an API, then you have a responsibility to delete references to it from the documentation and either delete it from the library or make it return with an error. Having it return silently just makes it annoying. I've wasted three days of my time and a year's worth of reduced-usefulness data over this issue. This vindicates my decision to return to Debian. Red Hat seems to have lost the plot.
OK ;-), I will give it a shot tomorrow... calm down.
try libpcap-0.6.2