[comp.protocols.tcp-ip] tcpdump for SunOS4.0

micky@cunixc.cc.columbia.edu (Micky Liu) (06/14/89)

As I continue to get tons of requests for my patches, and tons of
questions about them, let me try to answer them again.  I have taken
the code written by Van Jacobson and others at Lawrence Berkeley Labs
called tcpdump and modified it to run under SunOS4.0.  The original
code only ran under SunOS3.5.  This code can run only on Sun's and has
not been tested by me (or anyone else that I know) on anything other
that Sun-3's.

In order for the program to run properly under SunOS4.0, a kernel fix
is needed to repair the broken NIT interface.  Sun can supply you with
a new nit_if.o.  If this object is not incorporated into the kernel,
it will appear as if you are receiving duplicate ethernet packets.
This is because the bug manifests itself by making all of the
snapshots in each chunk identical.

I have been informed by Marc Lavine of 3Com (marcl@vax.spd.3com.com) 
that the program dumps core when decoding arp packets.  I don't know
if my diffs are causing this or if the problem occurs with the old
version, but if I get a chance I will attempt to find the problem...
So please use this stuff at your own risk.

For those of you still trying to get this stuff, the following is a list
of sites that I know of (there may be others...):

ftp.ee.lbl.gov           original sources for Sun-3's running SunOS3.5
devvax.tn.cornell.edu    patches to sources for SunOS4.0
titan.rice.edu           binaries for Sun-3's running SunOS3.5
ncar.ucar.edu            binaries for Sun-3's running SunOS4.0

The four sites listed above all provide anonymous ftp service, and
titan.rice.edu provides mail archive retrieval service, but I'm not
sure of the specifics.  Please try to retrieve the things that you
need from these sites before sending a note to me.  And please do not
ask me to mail the original sources, please try a near neighbor first.

If you have questions other than requests, I'd be happy to hear from
you (especially if you fixed the problem with the arp decoding).

Good Luck

Micky

  arpa: micky@cunixc.cc.columbia.edu
  uucp: ...!rutgers!columbia!cunixc!micky
bitnet: malua@cuvmc

barnett@crdgw1.crd.ge.com (Bruce G. Barnett) (06/28/89)

In article <1588@cunixc.cc.columbia.edu>, micky@cunixc (Micky Liu) writes:
>
>As I continue to get tons of requests for my patches, and tons of
>questions about them, let me try to answer them again.  I have taken
>the code written by Van Jacobson and others at Lawrence Berkeley Labs
>called tcpdump and modified it to run under SunOS4.0.

I came in late to this conversation, so forgive any redundant information.

The etherfind in SunOS 4.0 has been enhanced to provide most of the features
of tcpdump.

--
Bruce G. Barnett	<barnett@crdgw1.ge.com>  a.k.a. <barnett@[192.35.44.4]>
			uunet!crdgw1.ge.com!barnett barnett@crdgw1.UUCP