Wireshark · Ethereal-dev: Re: [ethereal-dev] AIX: gtk problem solved, now an ethereal problem

[Guy Harris <gharris@xxxxxxxxxxxx>]

> Inside bpf_open(), in pcap-bpf.c, the following is called with device equal
> to "/dev/bpf0", which exists in the /dev directory on my system.
> 
> fd = open(device, O_RDONLY); 
> 
> After this line, fd is set to 10, and errno is set to 0x4a, which is 
> "No buffer space available"
> 
> This causes pcap_open_live() to fail.

That *shouldn't* cause "pcap_open_live()" to fail - it should fail only
if "fd" is less than 0, i.e. if the "open()" returns -1.  The code in
"pcap-bpf.c" is:

	/*
	 * Go through all the minors and find one that isn't in use.
	 */
	do {
		(void)sprintf(device, "/dev/bpf%d", n++);
		fd = open(device, O_RDONLY);
	} while (fd < 0 && errno == EBUSY);

	/*
	 * XXX better message for all minors used
	 */
	if (fd < 0)
		sprintf(errbuf, "%s: %s", device, pcap_strerror(errno));

which should succeed unless all the "/dev/bpf" devices are already open
(or if there's an OS bug and a "/dev/bpf" device gets "stuck" open even
after it's closed).

The value of "errno" after a successful system call (i.e., one that
doesn't return -1) is normally the value it had before the system call,
so it's not significant.

"pcap_open_live()" can fail for a number of reasons, not all of which
are necessarily system call failures; if it fails, the error buffer
handed to it will have a string in it giving a reason for the error.  In
your program, try doing

  while (ifr < last){
    pch = pcap_open_live(ifr->ifr_name, WTAP_MAX_PACKET_SIZE, 0, 0, err_str);
    if (pch == NULL)
      printf("Failed to open %s with pcap_open_live, error=%s\n",ifr->ifr_name,err_str);
    else
      printf("Opened %s with pcap_open_live, pch=%p\n",ifr->ifr_name, pch);
#ifdef HAVE_SA_LEN
    ifr = (struct ifreq *) ((char *) ifr + ifr->ifr_addr.sa_len + IFNAMSIZ);
#else
    ifr = (struct ifreq *) ((char *) ifr + sizeof(struct ifreq));
#endif
  }                                                           

and see what that reports.