Add a bunch of notes from various "comp.sys.hp.hpux" threads about

tweaking HP-UX so that DLPI (and thus Ethereal/Tethereal and tcpdump)
can see, when capturing on a given machine, packets sent by that
machine.

svn path=/trunk/; revision=1660

1 files changed, 125 insertions, 1 deletions

diff --git a/README.hpux b/README.hpux
index 0af7cf8324..e53bbfd913 100644
--- a/README.hpux
+++ b/README.hpux
@@ -1,4 +1,4 @@
-$Id: README.hpux,v 1.9 2000/02/19 22:00:24 guy Exp $
+$Id: README.hpux,v 1.10 2000/02/21 20:41:01 guy Exp $
 
 Contents:
 
@@ -53,6 +53,130 @@ If you want to use Ethereal to capture packets, you will have to install
 HP-UX, which you should read if you're going to install and use
 "libpcap" on HP-UX.
 
+Note that packet-capture programs such as Ethereal/Tethereal or tcpdump
+may, on HP-UX, not be able to see packets sent from the machine on which
+they're running.  Some articles on Deja.com discussing this are:
+
+	http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=558092266
+
+which says:
+
+  Newsgroups: comp.sys.hp.hpux 
+  Subject:  Re: Did someone made tcpdump working on 10.20 ?
+  Date: 12/08/1999
+  From: Lutz Jaenicke <jaenicke@emserv1.ee.TU-Berlin.DE>
+
+  In article <82ks5i$5vc$1@news1.dti.ne.jp>, mtsat <mtsat@iris.dti.ne.jp>
+  wrote:
+   >Hello,
+   >
+   >I downloaded and compiled tcpdump3.4 a couple of week ago. I tried to use
+   >it, but I can only see incoming data, never outgoing.
+   >Someone (raj) explained me that a patch was missing, and that this patch
+   >must me "patched" (poked) in order to see outbound data in promiscuous mode.
+   >Many things to do .... So the question is : did someone has already this
+   >"ready to use" PHNE_**** patch ?
+  
+   Two things:
+   1. You do need a late "LAN products cumulative patch" (e.g.  PHNE_18173
+  for   s700/10.20).
+   2. You must use
+echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem
+     You can insert this e.g. into /sbin/init.d/lan
+  
+   Best regards,
+   Lutz
+
+and
+
+	http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=586287166
+
+which says:
+
+  Newsgroups: comp.sys.hp.hpux 
+  Subject: Re: tcpdump only shows incoming packets
+  Date: 02/15/2000
+  From: Rick Jones <foo@bar.baz.invalid>
+
+  Harald Skotnes <harald@cc.uit.no> wrote:
+  > I am running HPUX 11.0 on a C200 hanging on a 100Mb switch. I have
+  > compiled libpcap-0.4 an tcpdump-3.4 and it seems to work. But at a
+  > closer look I only get to see the incoming packets not the
+  > outgoing. I have tried tcpflow-0.12 which also uses libpcap and the
+  > same thing happens.  Could someone please give me a hint on how to
+  > get this right?
+  
+  Search/Read the archives ?-)
+  
+  What you are seeing is expected, un-patched, behaviour for an HP-UX
+  system.  On 11.00, you need to install the latest lancommon/DLPI
+  patches, and then the latest driver patch for the interface(s) in use. 
+  At that point, a miracle happens and you should start seeing outbound
+  traffic.
+
+[That article also mentions the patch that appears below.]
+
+and
+
+	http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=586494200
+
+which says:
+
+  Newsgroups: comp.sys.hp.hpux
+  Subject: Re: tcpdump only shows incoming packets
+  Date: 02/16/2000
+  From: Harald Skotnes <harald@cc.uit.no>
+
+  Rick Jones wrote:
+  
+	...
+
+  > What you are seeing is expected, un-patched, behaviour for an HP-UX
+  > system. On 11.00, you need to install the latest lancommon/DLPI
+  > patches, and then the latest driver patch for the interface(s) in
+  > use. At that point, a miracle happens and you should start seeing
+  > outbound traffic.
+  
+  Thanks a lot.  I have this problem on several machines running HPUX
+  10.20 and 11.00.  The machines where patched up before y2k so did not
+  know what to think.  Anyway I have now installed PHNE_19766,
+  PHNE_19826, PHNE_20008, PHNE_20735 on the C200 and now I can see the
+  outbound traffic too.  Thanks again.
+
+Another posting:
+
+	http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=457744130
+
+indicates that you need to install the optional STREAMS product to do
+captures on HP-UX 9.x:
+
+  Newsgroups: comp.sys.hp.hpux
+  Subject:  Re: tcpdump HP/UX 9.x
+  Date: 03/22/1999
+  From: Rick Jones <foo@bar.baz>
+
+  Dave Barr (barr@cis.ohio-state.edu) wrote:
+  : Has anyone ported tcpdump (or something similar) to HP/UX 9.x?
+  
+  I'm reasonably confident that any port of tcpdump to 9.X would require
+  the (then optional) STREAMS product.  This would bring DLPI, which is
+  what one uses to access interfaces in promiscuous mode.
+  
+  I'm not sure that HP even sells the 9.X STREAMS product any longer,
+  since HP-UX 9.X is off the pricelist (well, maybe 9.10 for the old 68K
+  devices). 
+  
+  Your best bet is to be up on 10.20 or better if that is at all
+  possible.  If your hardware is supported by it, I'd go with HP-UX 11. 
+  If you want to see the system's own outbound traffic, you'll never get
+  that functionality on 9.X, but it might happen at some point for 10.20
+  and 11.X. 
+  
+  rick jones
+
+(as per other messages cited here, the ability to see the system's own
+outbound traffic did happen).
+
 Another note, from a mail message to the "ethereal-users" list:
 
   Date: Wed, 22 Dec 1999 09:05:47 -0600 (EST)