Red Hat Bugzilla – Bug 39407
libpcap silently ignores pcap_lookupnet() calls
Last modified: 2008-05-01 11:38:00 EDT
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Description of problem:
Sometime in the last year or so, somebody replaced the
pcap_lookupnet() call in libpcap with a function that silently returns
without error, but does nothing. This despite the fact that the man page
(man pcap) still regards it as a valid function call.
Steps to Reproduce:
1. Try and compile and run a program that uses pcap_lookupnet()
2. Watch it return invalid results.
3. Better yet, look at the source code: libpcap-0.4/inet.c, line 170
This appears in a RedHat patch, so it's not in the standard libpcap. The
appropriate code is commented out with "All this function was a crap. --
ANK", which, while possibly entertaining, is not very professional. Either
the appropriate code should be restored, or a more useful reason given why
it was deleted (in which case the man page should be updated to reflect
that this function no longer works).
do you know why this was done?
sorry firstname.lastname@example.org, I meant email@example.com ...
Ask ANK. I just packaged ANK's changes, that was the Right Thing To Do for
linux at the time. Now that ANK's changes have been (mostly) merged into the
tcpdump.org base, and tcpdump is being maintained, other changes are probably
Aside: IMHO tying a network sniffer into lookups that can caues Yet More Traffic
is kinda crazy, so I also happen to agree with ANK. There are *lots* of ways
to get tricked when the network lookup lies to you ... <shrug>
Point taken. But it would be good if:
a) The function was removed from the man page (or, better, left there but noted
as disabled in this implementation)
b) The function returned an error instead of zero. This way we'd know that it
wasn't working, at least. I believe pcap_lookupdev() does the same thing, but I
Accepted under protest. I believe that if you're going to summarily delete a
function from an API, then you have a responsibility to delete references to it
from the documentation and either delete it from the library or make it return
with an error. Having it return silently just makes it annoying.
I've wasted three days of my time and a year's worth of reduced-usefulness data
over this issue.
This vindicates my decision to return to Debian. Red Hat seems to have lost the
OK ;-), I will give it a shot tomorrow... calm down.