Created attachment 386129 [details] patch to allow using 32bit pcap on 64bit kernel Description of problem: packet capturing not work if 32bit userspace application (tcpdump) running on 64bit kernel. (64bit tcpdump work well) Version-Release number of selected component (if applicable): tcpdump-3.9.4-14 libpcap-1.0.0 How reproducible: 32 bit : # tcpdump -i any icmp -s 0 19:22:40.1264160270 IP0 truncated-ip 0 19:22:40.1264160270 IP0 truncated-ip 0 19:22:40.1264160272 IP13 truncated-ip 0 64 bit: # tcpdump -i any icmp -s 0 14:39:36.232144 IP xxx.com > yyy.com: ICMP echo request, id 55161, seq 2, length 64 14:39:36.232164 IP yyy.com > xxx.com: ICMP echo reply, id 55161, seq 2, length 64 i expect that 32bit tcpdump should give the same results as 64 bit one. Additional info: yes, i use new version of libpcap (1.0.0) instead of distributed one ( 0.9.4 in tcpdump-3.9.4-15.el5.src.rpm as i can see in ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/ ). If i understand it right - bug is caused by the fact that kernel (2.6.18-164.6.1.el5) is not support TPACKET_V2 interface ( as http://article.gmane.org/gmane.network.tcpdump.devel/3170 ). So i make a simple patch to address this issue in userspace only, and i think it can be helpful for you too.
Created attachment 386131 [details] fix -m32 build (need to build 32bit libpcap.so on 64bit host)
Created attachment 386133 [details] patch to allow using 32bit pcap on 64bit kernel
Hello, thank you for the patch, but libpcap is working properly in version which is shipped in RHEL-5 and in this phase of RHEL-5 release cycle there is no intention to update libpcap to newer version, so I'll close this bug with resolution WONTFIX. If you have any further questions or comments related to this issue please feel free to write me an email.