Bug 28434

Summary: cs0's promiscuous mode does not work
Product: Base System Reporter: Chih-Chang Hsieh <cch.kmu.edu.tw>
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 4.3-RELEASE   
Hardware: Any   
OS: Any   

Description Chih-Chang Hsieh 2001-06-27 02:40:00 UTC 
	When we execute snort or trafshow2 of bpft on our 
	4.3-RELEASE box, we see ``cs0: promiscuous mode enabled'' 
	but it dose not capture any packets from or to any other 
	machines. All these machines are connected via a HUB.
	But under 3.5-STABLE, cs0's promiscuous mode works well.

Fix: 

unknown.
How-To-Repeat: 	Everytime when you execute snort or trafshow2 of bpft.
Comment 1 Jens Schweikhardt freebsd_committer freebsd_triage 2002-08-22 21:00:00 UTC 
State Changed
From-To: open->feedback

Does this problem persist?
Comment 2 Jens Schweikhardt 2002-09-03 21:16:49 UTC 
On Fri, Aug 23, 2002 at 08:00:21AM +0800, Chih-Chang Hsieh wrote:
# Jens Schweikhardt wrote:
# > Synopsis: cs0's promiscuous mode does not work
# > 
# > State-Changed-From-To: open->feedback
# > State-Changed-By: schweikh
# > State-Changed-When: Thu Aug 22 13:00:00 PDT 2002
# > State-Changed-Why: 
# > Does this problem persist?
# > 
# > http://www.freebsd.org/cgi/query-pr.cgi?pr=28434
# 
# I reported this problem when I use trafhow on 4.3.
# 
# Tcpdump works OK at least on 4.6-STABLE (Jul 22),
# 
# but trafhow still doesn't. Trafshow only shows
# 
# multicast and broadcast packets. Maybe it's
# 
# trafshow's problem.
# 
# Thanks for your concern.

If tcpdump works correctly (can set and use promiscuous mode) then it's
very likely not the kernel's but trafshow's problem. I'm much inclined
to close this PR but before I do maybe you can really confirm it's a
trafshow issue. Can you see any difference in the system calls when you
use ktrace or truss for both tcpdump and trafshow? Can both apps be run
simultaneously on that interface?

Regards,

	Jens
-- 
Jens Schweikhardt http://www.schweikhardt.net/
SIGSIG -- signature too long (core dumped)
Comment 3 Jens Schweikhardt freebsd_committer freebsd_triage 2002-09-06 16:46:34 UTC 
State Changed
From-To: feedback->closed

Closed at originator's request; problem no longer reproducible.