1 $Id: README.hpux,v 1.10 2000/02/21 20:41:01 guy Exp $
11 The Software Porting And Archive Centre for HP-UX, at
13 http://hpux.csc.liv.ac.uk/
15 (and with mirrors in various countries, listed on the Centre's home
16 page) has ported versions, in both source and binary form, for Ethereal,
17 as well as for the "libpcap", GLib, GTK+, "zlib", and CMU SNMP libraries
20 The changes they've made appear largely to be compile option changes; if
21 you've downloaded the source to the latest version of Ethereal (the
22 version on the Centre's site may not necessarily be the latest version),
23 it should be able to compile, perhaps with those changes.
25 They appear to have used HP-UX's "cc" compiler, with the options "-Ae
26 -O"; there's a comment "Add -Dhpux_9 if building under 9.X". It may
31 nettl is used on HP-UX to trace various streams based subsystems. Ethereal
32 can read nettl files containing IP frames (NS_LS_IP subsystem) and LAPB
33 frames (SX25L2 subsystem).
34 It has been tested with files generated on HP-UX 9.04 and 10.20.
36 Use the following commands to generate a trace (cf. nettl(1M)):
38 # IP capture. 0x30000000 means PDU in and PDU out :
39 nettl -tn 0x30000000 -e NS_LS_IP -f tracefile
40 # X25 capture. You must specify an interface :
41 nettl -tn 0x30000000 -e SX25l2 -d /dev/x25_0 -f tracefile
42 # stop capture. subsystem is NS_LS_IP or SX25L2 :
43 nettl -tf -e subsystem
45 One may be able to specify "-tn pduin pduout" rather than
46 "-tn 0x30000000"; the nettl man page for HP-UX 10.30 implies that it
49 3 - "libpcap" on HP-UX
51 If you want to use Ethereal to capture packets, you will have to install
52 "libpcap"; the INSTALL file for "libpcap" has several comments about
53 HP-UX, which you should read if you're going to install and use
56 Note that packet-capture programs such as Ethereal/Tethereal or tcpdump
57 may, on HP-UX, not be able to see packets sent from the machine on which
58 they're running. Some articles on Deja.com discussing this are:
60 http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=558092266
64 Newsgroups: comp.sys.hp.hpux
65 Subject: Re: Did someone made tcpdump working on 10.20 ?
67 From: Lutz Jaenicke <jaenicke@emserv1.ee.TU-Berlin.DE>
69 In article <82ks5i$5vc$1@news1.dti.ne.jp>, mtsat <mtsat@iris.dti.ne.jp>
73 >I downloaded and compiled tcpdump3.4 a couple of week ago. I tried to use
74 >it, but I can only see incoming data, never outgoing.
75 >Someone (raj) explained me that a patch was missing, and that this patch
76 >must me "patched" (poked) in order to see outbound data in promiscuous mode.
77 >Many things to do .... So the question is : did someone has already this
78 >"ready to use" PHNE_**** patch ?
81 1. You do need a late "LAN products cumulative patch" (e.g. PHNE_18173
84 echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem
85 You can insert this e.g. into /sbin/init.d/lan
92 http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=586287166
96 Newsgroups: comp.sys.hp.hpux
97 Subject: Re: tcpdump only shows incoming packets
99 From: Rick Jones <foo@bar.baz.invalid>
101 Harald Skotnes <harald@cc.uit.no> wrote:
102 > I am running HPUX 11.0 on a C200 hanging on a 100Mb switch. I have
103 > compiled libpcap-0.4 an tcpdump-3.4 and it seems to work. But at a
104 > closer look I only get to see the incoming packets not the
105 > outgoing. I have tried tcpflow-0.12 which also uses libpcap and the
106 > same thing happens. Could someone please give me a hint on how to
109 Search/Read the archives ?-)
111 What you are seeing is expected, un-patched, behaviour for an HP-UX
112 system. On 11.00, you need to install the latest lancommon/DLPI
113 patches, and then the latest driver patch for the interface(s) in use.
114 At that point, a miracle happens and you should start seeing outbound
117 [That article also mentions the patch that appears below.]
121 http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=586494200
125 Newsgroups: comp.sys.hp.hpux
126 Subject: Re: tcpdump only shows incoming packets
128 From: Harald Skotnes <harald@cc.uit.no>
134 > What you are seeing is expected, un-patched, behaviour for an HP-UX
135 > system. On 11.00, you need to install the latest lancommon/DLPI
136 > patches, and then the latest driver patch for the interface(s) in
137 > use. At that point, a miracle happens and you should start seeing
140 Thanks a lot. I have this problem on several machines running HPUX
141 10.20 and 11.00. The machines where patched up before y2k so did not
142 know what to think. Anyway I have now installed PHNE_19766,
143 PHNE_19826, PHNE_20008, PHNE_20735 on the C200 and now I can see the
144 outbound traffic too. Thanks again.
148 http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=457744130
150 indicates that you need to install the optional STREAMS product to do
151 captures on HP-UX 9.x:
153 Newsgroups: comp.sys.hp.hpux
154 Subject: Re: tcpdump HP/UX 9.x
156 From: Rick Jones <foo@bar.baz>
158 Dave Barr (barr@cis.ohio-state.edu) wrote:
159 : Has anyone ported tcpdump (or something similar) to HP/UX 9.x?
161 I'm reasonably confident that any port of tcpdump to 9.X would require
162 the (then optional) STREAMS product. This would bring DLPI, which is
163 what one uses to access interfaces in promiscuous mode.
165 I'm not sure that HP even sells the 9.X STREAMS product any longer,
166 since HP-UX 9.X is off the pricelist (well, maybe 9.10 for the old 68K
169 Your best bet is to be up on 10.20 or better if that is at all
170 possible. If your hardware is supported by it, I'd go with HP-UX 11.
171 If you want to see the system's own outbound traffic, you'll never get
172 that functionality on 9.X, but it might happen at some point for 10.20
177 (as per other messages cited here, the ability to see the system's own
178 outbound traffic did happen).
180 Another note, from a mail message to the "ethereal-users" list:
182 Date: Wed, 22 Dec 1999 09:05:47 -0600 (EST)
183 From: Gerald Combs <gerald@zing.org>
184 To: Lothar Seitter <lothar.seitter@arcormail.de>
185 cc: ethereal-users@zing.org
186 Subject: Re: [ethereal-users] permission problem with capturing
188 On Wed, 22 Dec 1999, Lothar Seitter wrote:
190 > running 'ethereal' under HP-UX 11 with root permission and
191 > /dev/lan0 set to 777, I always get the message:
192 > "There are no network interfaces that can be opened.
193 > Please to make sure you have sufficient permission to
196 > I start ethereal with 'etheral -i lan0' and lan0 is definitely
199 > What am I missing???
201 You may need to reference the card's DLPI device directly. We were having
202 trouble getting Ethereal to capture on an HP-UX 10.20 machine here. I
203 found an article on Deja News that says:
205 "To access a particular interface, you would say "tcpdump -i /dev/dlpiN"
206 where N is the PPA of the interface you wish to use. You get the PPA by
207 looking at the output of lanscan. On 10.20, it is the same value as the
208 NMID. On 11.X, it is the Card Instance number."
210 This didn't help in our case, but it might in yours. The full article is
211 at http://x34.deja.com/[ST_rn=ps]/getdoc.xp?AN=549366486 .
213 Another article by the same author mentions that experimental versions of
214 libpcap and tcpdump are available at
215 ftp://ftp.cup.hp.com/dist/networking/tools/ . The article itself is at
216 http://x34.deja.com/[ST_rn=ps]/getdoc.xp?AN=558665378 .
218 The first of those articles also says:
220 BTW, before you have to make a follow-up post, you will find that
221 unless you have the latest lan common/DLPI/driver patches installed,
222 you will _not_ see the system's own outbound traffic.
224 It appears that a consequence of the fact that HP-UX's DLPI doesn't work
225 like Solaris's, in that, on Solaris, to get at the device "hme0", say,
226 "libpcap" has to open "/dev/hme" and then tell it to use the 0th
227 interface, whilst on HP-UX you have to go through "/dev/dlpi", you won't
228 get a list of interfaces in the dialog box for "Capture:Start" - you'll
229 have to do through the aforementioned song and dance to find the PPA of
230 the interface you want to use, and supply the "dlpiN" name by hand (I
231 think you can omit the "/dev/" in both tcpdump and Ethereal).
233 Here is a patch to "pcap-dlpi.c" in libpcap that, at least on HP-UX
234 11.X, allows the name of the network interface, rather than the "dlpiN"
235 name, to be specified to tcpdump and Ethereal. It has not been tried on
236 HP-UX 10.20; it fixes one bug that could have caused the code in vanilla
237 libpcap not to correctly find the PPA for an interface on HP-UX 10.20,
238 but HP-UX 10.20's DLPI doesn't supply, in the data returned by a
239 DL_HP_PPA_REQ request, network interface names, so, on systems without
240 the network interface names in that data, the code continues to check
241 the major device number.
243 On HP-UX 11.00, the patch allows a network interface to be specified by
244 name as an argument to tcpdump, rather than requiring that you specify a
245 "dlpiN" name (and it should work equally well with Ethereal).
247 If you try this code on HP-UX 10.20, and it doesn't let you specify the
248 interface by name, please send mail to ethereal-dev@zing.org, so that we
249 know that it didn't work - we'll probably send you debugging patches in
250 the hopes of being able to make it work on 10.20 as well.
252 Here's the patch (to vanilla libpcap 0.4; it patches "configure",
253 "aclocal.m4", and "configure.in", to make the configure script check
254 whether your version of HP-UX supplies the interface names in the reply
255 to a DL_HP_PPA_REQ request, and "pcap-dlpi.c"):
257 *** ../libpcap-0.4/configure Sat Jul 25 12:41:51 1998
258 --- configure Fri Jan 14 00:40:04 2000
264 echo $ac_n "checking if unaligned accesses fail""... $ac_c" 1>&6
265 ! echo "configure:1707: checking if unaligned accesses fail" >&5
266 if eval "test \"`echo '$''{'ac_cv_lbl_unaligned_fail'+set}'`\" = set"; then
267 echo $ac_n "(cached) $ac_c" 1>&6
273 + echo $ac_n "checking if dl_hp_ppa_info_t struct has dl_module_id_1 member""... $ac_c" 1>&6
274 + echo "configure:1707: checking if dl_hp_ppa_info_t struct has dl_module_id_1 member" >&5
275 + if eval "test \"`echo '$''{'ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1'+set}'`\" = set"; then
276 + echo $ac_n "(cached) $ac_c" 1>&6
278 + cat > conftest.$ac_ext <<EOF
279 + #line 1712 "configure"
280 + #include "confdefs.h"
282 + # include <sys/types.h>
283 + # include <sys/dlpi.h>
284 + # include <sys/dlpi_ext.h>
286 + u_int i = sizeof(((dl_hp_ppa_info_t *)0)->dl_module_id_1)
289 + if { (eval echo configure:1722: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
291 + ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1=yes
293 + echo "configure: failed program was:" >&5
294 + cat conftest.$ac_ext >&5
296 + ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1=no
301 + echo "$ac_t""$ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1" 1>&6
302 + if test $ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1 = yes ; then
303 + cat >> confdefs.h <<\EOF
304 + #define HAVE_HP_PPA_INFO_T_DL_MODULE_ID_1 1
309 echo $ac_n "checking if unaligned accesses fail""... $ac_c" 1>&6
310 ! echo "configure:1743: checking if unaligned accesses fail" >&5
311 if eval "test \"`echo '$''{'ac_cv_lbl_unaligned_fail'+set}'`\" = set"; then
312 echo $ac_n "(cached) $ac_c" 1>&6
316 # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff"
317 # ./install, which can be erroneously created by make from ./install.sh.
318 echo $ac_n "checking for a BSD compatible install""... $ac_c" 1>&6
319 ! echo "configure:1803: checking for a BSD compatible install" >&5
320 if test -z "$INSTALL"; then
321 if eval "test \"`echo '$''{'ac_cv_path_install'+set}'`\" = set"; then
322 echo $ac_n "(cached) $ac_c" 1>&6
324 # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff"
325 # ./install, which can be erroneously created by make from ./install.sh.
326 echo $ac_n "checking for a BSD compatible install""... $ac_c" 1>&6
327 ! echo "configure:1839: checking for a BSD compatible install" >&5
328 if test -z "$INSTALL"; then
329 if eval "test \"`echo '$''{'ac_cv_path_install'+set}'`\" = set"; then
330 echo $ac_n "(cached) $ac_c" 1>&6
333 *** ../libpcap-0.4/aclocal.m4 Fri Jun 12 03:45:15 1998
334 --- aclocal.m4 Tue Jan 4 21:02:13 2000
341 + dnl Checks to see if the dl_hp_ppa_info_t struct has the HP-UX 11.00
342 + dnl dl_module_id_1 member
346 + dnl AC_LBL_HP_PPA_INFO_T_DL_MODULE_ID_1
350 + dnl HAVE_HP_PPA_INFO_T_DL_MODULE_ID_1 (defined)
352 + dnl NOTE: any compile failure means we conclude that it doesn't have
353 + dnl that member, so if we don't have DLPI, don't have a <sys/dlpi_ext.h>
354 + dnl header, or have one that doesn't declare a dl_hp_ppa_info_t type,
355 + dnl we conclude it doesn't have that member (which is OK, as either we
356 + dnl won't be using code that would use that member, or we wouldn't
357 + dnl compile in any case).
359 + AC_DEFUN(AC_LBL_HP_PPA_INFO_T_DL_MODULE_ID_1,
360 + [AC_MSG_CHECKING(if dl_hp_ppa_info_t struct has dl_module_id_1 member)
361 + AC_CACHE_VAL(ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1,
363 + # include <sys/types.h>
364 + # include <sys/dlpi.h>
365 + # include <sys/dlpi_ext.h>],
366 + [u_int i = sizeof(((dl_hp_ppa_info_t *)0)->dl_module_id_1)],
367 + ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1=yes,
368 + ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1=no))
369 + AC_MSG_RESULT($ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1)
370 + if test $ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1 = yes ; then
371 + AC_DEFINE(HAVE_HP_PPA_INFO_T_DL_MODULE_ID_1)
375 dnl Checks to see if -R is used
380 *** ../libpcap-0.4/configure.in Sun Jul 27 22:16:22 1997
381 --- configure.in Tue Jan 4 21:02:13 2000
386 AC_LBL_SOCKADDR_SA_LEN
388 + AC_LBL_HP_PPA_INFO_T_DL_MODULE_ID_1
390 AC_LBL_UNALIGNED_ACCESS
392 if test "${srcdir}" = "." ; then
394 *** ../libpcap-0.4/pcap-dlpi.c Wed Oct 15 21:59:34 1997
395 --- pcap-dlpi.c Tue Jan 4 21:02:13 2000
399 memset(p, 0, sizeof(*p));
402 ! ** Determine device and ppa
404 ! cp = strpbrk(device, "0123456789");
406 sprintf(ebuf, "%s missing unit number", device);
410 memset(p, 0, sizeof(*p));
412 + #ifdef HAVE_DEV_DLPI
414 ! ** Remove any "/dev/" on the front of the device.
416 ! cp = strrchr(device, '/');
424 ! * Split the name into a device type and a unit number.
426 ! cp = strpbrk(dname, "0123456789");
428 sprintf(ebuf, "%s missing unit number", device);
432 sprintf(ebuf, "%s bad unit number", device);
436 ! if (*device == '/')
437 ! strcpy(dname, device);
439 ! sprintf(dname, "%s/%s", PCAP_DEV_PREFIX, device);
440 ! #ifdef HAVE_DEV_DLPI
441 ! /* Map network device to /dev/dlpi unit */
443 if ((p->fd = open(cp, O_RDWR)) < 0) {
444 sprintf(ebuf, "%s: %s", cp, pcap_strerror(errno));
447 ! /* Map network interface to /dev/dlpi unit */
448 ppa = get_dlpi_ppa(p->fd, dname, ppa, ebuf);
452 /* Try device without unit number */
453 strcpy(dname2, dname);
454 cp = strchr(dname, *cp);
456 sprintf(ebuf, "%s bad unit number", device);
462 ! * Use "/dev/dlpi" as the device.
464 ! * XXX - HP's DLPI Programmer's Guide for HP-UX 11.00 says that
465 ! * the "dl_mjr_num" field is for the "major number of interface
466 ! * driver"; that's the major of "/dev/dlpi" on the system on
467 ! * which I tried this, but there may be DLPI devices that
468 ! * use a different driver, in which case we may need to
469 ! * search "/dev" for the appropriate device with that major
470 ! * device number, rather than hardwiring "/dev/dlpi".
472 ! * I'm assuming that the code that was used for HP-UX 10.x
473 ! * is valid, and therefore that, in 10.x, DLPIable devices have
474 ! * "/dev" entries corresponding to them and that their
475 ! * major device number is what appears in the "dl_hp_ppa_info_t"
476 ! * structure for that device. We can search by name in 11.x
477 ! * (and we may have to, as it's not clear that DLPIable devices
478 ! * will have those sorts of "/dev" entries), but we can't in
479 ! * 10.x, as 10.x doesn't have the "dl_module_id_1" and
480 ! * "dl_module_id_2" members in the "dl_hp_ppa_info_t" structure.
483 if ((p->fd = open(cp, O_RDWR)) < 0) {
484 sprintf(ebuf, "%s: %s", cp, pcap_strerror(errno));
489 ! * Get a table of all PPAs for that device, and search that
490 ! * table for the specified device type name and unit number.
492 ppa = get_dlpi_ppa(p->fd, dname, ppa, ebuf);
497 + ** Determine device and ppa
499 + cp = strpbrk(device, "0123456789");
501 + sprintf(ebuf, "%s missing unit number", device);
504 + ppa = strtol(cp, &eos, 10);
505 + if (*eos != '\0') {
506 + sprintf(ebuf, "%s bad unit number", device);
510 + if (*device == '/')
511 + strcpy(dname, device);
513 + sprintf(dname, "%s/%s", PCAP_DEV_PREFIX, device);
515 /* Try device without unit number */
516 strcpy(dname2, dname);
517 cp = strchr(dname, *cp);
523 ! sprintf(ebuf, "unknown mac type 0x%lu", infop->dl_mac_type);
531 ! sprintf(ebuf, "unknown mac type 0x%lu",
532 ! (unsigned long)infop->dl_mac_type);
539 #ifdef DL_HP_PPA_ACK_OBS
541 ! * Under HP-UX 10, we can ask for the ppa
547 #ifdef DL_HP_PPA_ACK_OBS
549 ! * Under HP-UX 10 and HP-UX 11, we can ask for the ppa
557 register dl_hp_ppa_ack_t *ap;
558 ! register dl_hp_ppa_info_t *ip;
560 register u_long majdev;
561 - dl_hp_ppa_req_t req;
563 bpf_u_int32 buf[MAXDLBUF];
565 ! if (stat(device, &statbuf) < 0) {
566 ! sprintf(ebuf, "stat: %s: %s", device, pcap_strerror(errno));
569 majdev = major(statbuf.st_rdev);
571 memset((char *)&req, 0, sizeof(req));
572 req.dl_primitive = DL_HP_PPA_REQ;
576 register dl_hp_ppa_ack_t *ap;
577 ! register dl_hp_ppa_info_t *ipstart, *ip;
579 + #ifndef HAVE_HP_PPA_INFO_T_DL_MODULE_ID_1
581 register u_long majdev;
584 + dl_hp_ppa_req_t req;
585 bpf_u_int32 buf[MAXDLBUF];
587 ! #ifndef HAVE_HP_PPA_INFO_T_DL_MODULE_ID_1
589 ! * HP-UX 10 doesn't put the interface name in the
590 ! * "dl_hp_ppa_info_t" structure, so we have to
591 ! * try to get the major device number for the device
592 ! * corresponding to the device and unit name provided to
593 ! * us, and search for the entry with that major device number.
595 ! sprintf(dname, "/dev/%s%d", device, unit);
596 ! if (stat(dname, &statbuf) < 0) {
597 ! sprintf(ebuf, "stat: %s: %s", dname, pcap_strerror(errno));
600 majdev = major(statbuf.st_rdev);
603 memset((char *)&req, 0, sizeof(req));
604 req.dl_primitive = DL_HP_PPA_REQ;
609 ap = (dl_hp_ppa_ack_t *)buf;
610 ! ip = (dl_hp_ppa_info_t *)((u_char *)ap + ap->dl_offset);
612 for(i = 0; i < ap->dl_count; i++) {
613 ! if (ip->dl_mjr_num == majdev && ip->dl_instance_num == unit)
616 ! ip = (dl_hp_ppa_info_t *)((u_char *)ip + ip->dl_next_offset);
618 if (i == ap->dl_count) {
619 ! sprintf(ebuf, "can't find PPA for %s", device);
622 if (ip->dl_hdw_state == HDW_DEAD) {
623 ! sprintf(ebuf, "%s: hardware state: DOWN\n", device);
626 return ((int)ip->dl_ppa);
630 ap = (dl_hp_ppa_ack_t *)buf;
631 ! ipstart = (dl_hp_ppa_info_t *)((u_char *)ap + ap->dl_offset);
634 for(i = 0; i < ap->dl_count; i++) {
635 ! #ifdef HAVE_HP_PPA_INFO_T_DL_MODULE_ID_1
636 ! if ((strcmp(ip->dl_module_id_1, device) == 0 ||
637 ! strcmp(ip->dl_module_id_2, device) == 0) &&
639 ! if (ip->dl_mjr_num == majdev &&
641 ! ip->dl_instance_num == unit)
644 ! ip = (dl_hp_ppa_info_t *)((u_char *)ipstart + ip->dl_next_offset);
646 if (i == ap->dl_count) {
647 ! sprintf(ebuf, "can't find PPA for %s%d", device, unit);
650 if (ip->dl_hdw_state == HDW_DEAD) {
651 ! sprintf(ebuf, "%s%d: hardware state: DOWN\n", device, unit);
654 return ((int)ip->dl_ppa);
660 ! char if_name[sizeof(ifnet.if_name)], tifname[32];
662 cp = strrchr(ifname, '/');
668 ! char if_name[sizeof(ifnet.if_name) + 1];
670 cp = strrchr(ifname, '/');
674 if (dlpi_kread(kd, (off_t)addr,
675 &ifnet, sizeof(ifnet), ebuf) < 0 ||
676 dlpi_kread(kd, (off_t)ifnet.if_name,
677 ! if_name, sizeof(if_name), ebuf) < 0) {
681 ! sprintf(tifname, "%.*s%d",
682 ! (int)sizeof(if_name), if_name, ifnet.if_unit);
683 ! if (strcmp(tifname, ifname) == 0)
684 return (ifnet.if_index);
688 if (dlpi_kread(kd, (off_t)addr,
689 &ifnet, sizeof(ifnet), ebuf) < 0 ||
690 dlpi_kread(kd, (off_t)ifnet.if_name,
691 ! if_name, sizeof(ifnet.if_name), ebuf) < 0) {
695 ! if_name[sizeof(ifnet.if_name)] = '\0';
696 ! if (strcmp(if_name, ifname) == 0 && ifnet.if_unit == unit)
697 return (ifnet.if_index);