Ethereal-dev: Re: [Ethereal-dev] Interface not listed

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 26 Dec 2004 03:16:59 -0800
Glenn Talbott wrote:

Hmm... Yes, you are right that config.h (I assume you mean
/usr/src/linux-2.4.18-14/include/linux/config.h which
Simply says #include linux/autoconf.h)

No - I was referring to the config.h in the libpcap source tree, as generated by libpcap's configure script.

does not contain HAVE_PROC_NET_DEV.
However I'm not convinced that the failure to find eth1 is a bug in RH 8.
The question that comes to mind is if libpcap requires HAVE_PROC_NET_DEV to
find eth1, then how does it find eth0? ... Never mind, I found the answer
myself. From libpcap-0.7.2/inet.c:

#ifdef HAVE_PROC_NET_DEV
        if (ret != -1) {
                /*
                 * We haven't had any errors yet; now read "/proc/net/dev",
                 * and add to the list of interfaces all interfaces listed
                 * there that we don't already have, because, on Linux,
                 * SIOCGIFCONF reports only interfaces with IPv4 addresses,
                 * so you need to read "/proc/net/dev" to get the names of
                 * the rest of the interfaces.
                 */
                ret = scan_proc_net_dev(&devlist, fd, errbuf);
        }
#endif

And I have specifically _not_ bound IP to eth1.

So, do newer versions of libpcap know how to workaround the missing
HAVE_PROC_NET_DEV in RH 8,

There's nothing to work around - the config.h from which HAVE_PROC_NET_DEV presumably missing (because it didn't try to read /proc/net/dev) is *part* of libpcap, it's not a configuration file external to libpcap over which libpcap has no control. Either

1) there's a problem in libpcap's configure script, so that it doesn't find /proc/net/dev even though it's obviously present and readable, at least on your machine

or

2) even when HAVE_PROC_NET_DEV is defined, libpcap still doesn't check /proc/net/dev (although looking at the code, that shouldn't happen - and I think I tested it on a Linux box when I wrote that code)

or

3) it wasn't present on the machine on which the configure script was run by Red Hat (in which case perhaps some other mechanism should be used to determine whether libpcap should try to use "/proc/net/dev")

or

4) Red Hat either didn't bother to run the configure script as part of the build procedure, and instead provided their own hand-built config.h, or ran the configure script and hand-edited it to remove the definition of HAVE_PROC_NET_DEV (in which case they should either stop doing that or should explain why they're doing that and why libpcap should be doing something other than scanning /proc/net/dev)

or

5) RH 8.0 has "getifaddrs()", but it's a buggy (or, at least, arguably deficient) implementation that assumes the caller is only interested in interfaces with IPv4 addresses and thus only does SIOCGIFCONF (although the one Linux "getifaddrs()" implementation I've seen, the Usagi one, doesn't do that, as I remember).

Trying libpcap 0.7.2 from http://www.tcpdump.org would be interesting, as it might indicate which of those is the case, and thus indicate whether there's a problem with libpcap or with RH 8.0.