Tcpdump error

[Brouno]

Hello,

I'm trying to check traffic on WAN intf with tcpdump 4.2.1 / libpcap 1.3.0 from the Entware official repo

I get an error "tcpdump: eth0: SIOETHTOOL(ETHTOOL_GTSO) ioctl failed: Invalid argument"

admin@RT-N66U:/tmp/home/root# opkg install tcpdump
Installing tcpdump (4.2.1-3) to root...
Downloading http://wl500g-repo.googlecode.com/svn/ipkg/openwrt/tcpdump_4.2.1-3_entware.ipk.
Installing libpcap (1.3.0-1) to root...
Downloading http://wl500g-repo.googlecode.com/svn/ipkg/openwrt/libpcap_1.3.0-1_entware.ipk.
Configuring libpcap.
Configuring tcpdump.
admin@RT-N66U:/tmp/home/root# tcpdump -i eth0
tcpdump: eth0: SIOETHTOOL(ETHTOOL_GTSO) ioctl failed: Invalid argument

I get the same error for vlan1 (normal, vlan1 is same as eth0)
It's working like a charm on eth1, eth2, br0

I read on sourceforge an explanation for the previous version of libpcap, here :http://sourceforge.net/tracker/index.php?func=detail&aid=3572006&group_id=53067&atid=469577

I am using tcpdump 4.2.1 / libpcap 1.2.1 on a BCM4716-based router (mipsel-linux-uclibc, kernel 2.6.23)
Packet capture on vlan interfaces would not start with the following error:
SIOETHTOOL( ETHTOOL_GTSO) ioctl failed: Invalid argument.
This is apparently coming from pcap-linux.c / iface_ethtool_ioctl()

I believe ioctl would return EINVAL if a certain ioctl is not supported by the device, so the code should probably look like
if (ioctl(handle->fd, SIOCETHTOOL, &ifr) == -1) {
if (errno == EOPNOTSUPP || errno == EINVAL) {


This change has fixed the error on my system and I am now able to do packet capture on vlan devices

As I'm not able to check/compile/build package of libpcap (limits of my skills ;-) ), is there someone which get/can compile the libpcap with the patch ?
Or perhap's a link to a repo which get other/correct libpcap version ? (I already tried some, but with no success)

NB : I'm using a RT-N66U with last merlin build Asuswrt-Merlin 3.0.0.4.354.28 Beta 1, but I assume that's not the problem
Thanks a lot

 

[Brouno]

I reply to myself for reference.

I finally manage to cross compile libpcap 1.3.0 with the patch referenced in my previous post

Using infos from here : https://github.com/RMerl/asuswrt-merlin/wiki/Compile-Firmware-from-source-using-Ubuntu
& here : http://tiebing.blogspot.fr/2010/12/corss-compile-tcpdump-for-linuxmips.html

and libpcap is now working and able to sniff traffic on eth0 (using tcpdump or other tools like darkstat)

the only "drawback" is that my own compiled libpcap is ~540Ko while the "official" one (from repo) is ~220Ko

I suspect some compilation options not very accurate, btw, it's working

For those interested just install the official libpcap through optware/entware then replace /tmp/mnt/sda1/asusware/lib/libpcap.so.1.3.0 with this one from my dropbox :

edit : recompilation see below other post : http://forums.smallnetbuilder.com/showpost.php?p=69671&postcount=5

 

[ryzhov_al]

lly says this is a kernel API malfunction in et driver. Better to fix it.

Eric?

 

[RMerlin]

lly says this is a kernel API malfunction in et driver. Better to fix it.

Eric?

I'd have to see if Asuswrt uses a newer closed-source driver or the same open-source code as WL500G.

Currently got my hands full with the debugging of cstats (making a lot of progress thankfully), and with other new toys I got on my hands, so not sure when I'll get the chance to get around to it.

 

[Brouno]

Great to know the explanation. Thank you for reply

I recompiled patched libpcap with "-mtune=mips32 -mips32 -Os" compiler flags, size is now ~250Ko better

File "libpcap.so.1.3.0" mipsel here : https://dl.dropboxusercontent.com/u/7010140/libpcap.so.1.3.0

 

[ryzhov_al]

Ok. I've made those workaround in Entware repo because TomatoUSB kernel suffers with this bug too.

 

[Brouno]

Great !

I see the libpcap 1.3.0-1a , already upgrade to this one and ... working ;-)

Thx