Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!uwm.edu!zaphod.mps.ohio-state.edu!lavaca.uh.edu!menudo.uh.edu!apt
From: apt@menudo.uh.edu (Alan Pfeiffer-Traum)
Newsgroups: comp.unix.ultrix
Subject: Re: tcpdump for Ultrix 4.x?
Message-ID: <1991Jan17.030314.12031@menudo.uh.edu>
Date: 17 Jan 91 03:03:14 GMT
References: <2793D979.17547@orion.oac.uci.edu>
	<1991Jan17.011450.20461@pa.dec.com>
Sender: apt@menudo.uh.edu (Alan Pfeiffer-Traum)
Organization: University of Houston
Lines: 36
In-Reply-To: mogul@wrl.dec.com's message of Thu, 17 Jan 91 01:14:50 GMT

>>>>> On Thu, 17 Jan 91 01:14:50 GMT, mogul@wrl.dec.com (Jeffrey Mogul)
>>>>> said:

Mike> In article <2793D979.17547@orion.oac.uci.edu>
Mike> iglesias@draco.acs.uci.edu (Mike Iglesias) writes:

Mike> Does anyone know of/have changes to make tcpdump work under Ultrix
Mike> 4.x?  We're running 4.1 on DECstations if that makes a difference.

Jeffrey> Fortunately for you, I've been working on and off for months
Jeffrey> with the LBL crew to get their code to work on Ultrix 4.x.

My thanks to Jeffrey Mogul for contributing his time adapting this
wonderful tool (and for his earlier work on nfswatch). However, I should
point out a nasty gotcha that appears when enabling the ethernet
controller for promiscuous mode (using the packetfiler) under ULTRIX
4.1.

If the system is also running LAT, you can expect to see *major*
disruption to other LAT services on the LAN. This is a "known problem"
as verified by the CSC ULTRIX Networking Team. I don't know the exact
nature of the problem. But, in my case while I was running nfswatch
DECserver users attempting to connect to various LAT services received
a message indicating a "remote protocol error". I cleared this condition
only by rebooting my system. This problem is peculiar to ULTRIX 4.1. I
have seen no problems using the packetfilter under ULTRIX 4.0.

The indications from CSC note that this problem is fixed in the next
release (don't expect a patch).

If you don't run LAT on your 4.1 system, promiscuous mode can be enabled
without hazard to the innocent. However, in this case I've noticed that
you can't *disable* promiscuous mode - short of rebooting.
-- 
Alan Pfeiffer-Traum
University of Houston