From cch@c198.cc.kmu.edu.tw  Tue Jun 26 18:37:05 2001
Return-Path: <cch@c198.cc.kmu.edu.tw>
Received: from c198.cc.kmu.edu.tw (c198.cc.kmu.edu.tw [163.15.154.198])
	by hub.freebsd.org (Postfix) with ESMTP id 87A3E37B401
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 26 Jun 2001 18:37:03 -0700 (PDT)
	(envelope-from cch@c198.cc.kmu.edu.tw)
Received: (from cch@localhost)
	by c198.cc.kmu.edu.tw (8.11.4/8.11.4) id f5R1b2123212;
	Wed, 27 Jun 2001 09:37:02 +0800 (CST)
	(envelope-from cch)
Message-Id: <200106270137.f5R1b2123212@c198.cc.kmu.edu.tw>
Date: Wed, 27 Jun 2001 09:37:02 +0800 (CST)
From: Chih-Chang Hsieh <cch.kmu.edu.tw@c198.cc.kmu.edu.tw>
Reply-To: Chih-Chang Hsieh <cch@kmu.edu.tw>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: cs0's promiscuous mode does not work
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         28434
>Category:       kern
>Synopsis:       cs0's promiscuous mode does not work
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Jun 26 18:40:00 PDT 2001
>Closed-Date:    Fri Sep 06 08:48:48 PDT 2002
>Last-Modified:  Fri Sep 06 08:48:48 PDT 2002
>Originator:     Chih-Chang Hsieh
>Release:        FreeBSD 4.3-RELEASE i386
>Organization:
KMU Computer Center
>Environment:
System: FreeBSD snort.kmu.edu.tw 4.3-RELEASE FreeBSD 4.3-RELEASE #0: Tue Apr 24 10:23:29 CST 2001     root@snort.kmu.edu.tw:/usr/src/sys/compile/SNORT  i386
machine: Pentium/P54C (199.43-MHz 586-class CPU)

>Description:
	When we execute snort or trafshow2 of bpft on our 
	4.3-RELEASE box, we see ``cs0: promiscuous mode enabled'' 
	but it dose not capture any packets from or to any other 
	machines. All these machines are connected via a HUB.
	But under 3.5-STABLE, cs0's promiscuous mode works well.
	
>How-To-Repeat:
	Everytime when you execute snort or trafshow2 of bpft.
>Fix:
	unknown.
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: schweikh 
State-Changed-When: Thu Aug 22 13:00:00 PDT 2002 
State-Changed-Why:  
Does this problem persist? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=28434 

From: Jens Schweikhardt <schweikh@schweikhardt.net>
To: Chih-Chang Hsieh <cch@cc.kmu.edu.tw>
Cc: GNATS Bug Followup <bug-followup@FreeBSD.org>
Subject: Re: kern/28434: cs0's promiscuous mode does not work
Date: Tue, 3 Sep 2002 22:16:49 +0200

 On Fri, Aug 23, 2002 at 08:00:21AM +0800, Chih-Chang Hsieh wrote:
 # Jens Schweikhardt wrote:
 # > Synopsis: cs0's promiscuous mode does not work
 # > 
 # > State-Changed-From-To: open->feedback
 # > State-Changed-By: schweikh
 # > State-Changed-When: Thu Aug 22 13:00:00 PDT 2002
 # > State-Changed-Why: 
 # > Does this problem persist?
 # > 
 # > http://www.freebsd.org/cgi/query-pr.cgi?pr=28434
 # 
 # I reported this problem when I use trafhow on 4.3.
 # 
 # Tcpdump works OK at least on 4.6-STABLE (Jul 22),
 # 
 # but trafhow still doesn't. Trafshow only shows
 # 
 # multicast and broadcast packets. Maybe it's
 # 
 # trafshow's problem.
 # 
 # Thanks for your concern.
 
 If tcpdump works correctly (can set and use promiscuous mode) then it's
 very likely not the kernel's but trafshow's problem. I'm much inclined
 to close this PR but before I do maybe you can really confirm it's a
 trafshow issue. Can you see any difference in the system calls when you
 use ktrace or truss for both tcpdump and trafshow? Can both apps be run
 simultaneously on that interface?
 
 Regards,
 
 	Jens
 -- 
 Jens Schweikhardt http://www.schweikhardt.net/
 SIGSIG -- signature too long (core dumped)
State-Changed-From-To: feedback->closed 
State-Changed-By: schweikh 
State-Changed-When: Fri Sep 6 08:46:34 PDT 2002 
State-Changed-Why:  
Closed at originator's request; problem no longer reproducible. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=28434 
>Unformatted:


Originator reports:
 Today I redo the tests, trafshow works now -- it's a little strange.
 Both trafshow and tcpdump can be run simutaneously and works correctly
 on cs. I think the PR can be closed. Thank you.

