Re: Trouble with tcpdump, iftop and p0f

[Dave Barnett <barnetda@blueriver.net>]

BERTRAND Joel wrote:
>     Hello,
>
>     I use debian/squeeze on some UltraSPARC workstations (U1, U2, U60, 
> U420). For some bad reasons (a netdev watchdog error), all sparc run 
> with a 2.6.28.x kernel. I have seen that tcpdump, iftop and p0f do not 
> work anymore. For example, tcpdump returns nothing but number of 
> packets :
>
>
> Root rayleigh:[~] > tcpdump -i eth0
> tcpdump: verbose output suppressed, use -v or -vv for full protocol 
> decode
> listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
> ^C
> 0 packets captured
> 14 packets received by filter
> 0 packets dropped by kernel
> Root rayleigh:[~] >
>
> iftop always returns 0. /proc/net/dev seems to be good :
> Root rayleigh:[/proc/net] > cat dev
> Inter-|   Receive                                                |  
> Transmit
>  face |bytes    packets errs drop fifo frame compressed 
> multicast|bytes    packets errs drop fifo colls carrier compressed
>     lo:43971241  156634    0    0    0     0          0         0 
> 43971241  156634    0    0    0     0       0          0
>   eth0:1608389814 1409399    0    0    0     0          0         0 
> 742904638 1130191    0    0    0     0       0          0
>   eth1:1213900034 1046099    0    0    0     0          0         0 
> 144409047  649625    0    0    0     0       0          0
>   eth2: 4189275   54803    0    0    1     0          0         0 
> 98600399   81729    0    0    0     0       0          0
> Root rayleigh:[/proc/net] >
>
>     Have you seen this bug ? Is there an issue ?
>
>     Regards,
>
>     JKB

I see the same issue with 2.6.18-6 on ultra10 running unstable.  Neither 
tcpdump nor itop do anything useful and my /proc/net/dev looks fine, as 
far as I know.

tank:~/firewall# uname -a
Linux tank 2.6.18-6-sparc64 #1 Fri Dec 12 17:12:19 UTC 2008 sparc64 
GNU/Linux
tank:~/firewall# !cat
cat /proc/net/dev
Inter-|   Receive                                                |  Transmit
face |bytes    packets errs drop fifo frame compressed 
multicast|bytes    packets errs drop fifo colls carrier compressed
   lo:  335862    3686    0    0    0     0          0         0   
335862    3686    0    0    0     0       0          0
 eth0:666017495 4093427    0    0    0     0          0         0 
2253782292 4669853    1    0    1     0       1          0
 eth1:2079392970 3204855    1    0    0     0          0         0 
557331808 2617716    0    0    0     0       0          0
 sit0:       0       0    0    0    0     0          0         0        
0       0    0    0    0     0       0          0


Sounds like a bug of some sort to me.....

[Sorry for the delayed response; I normally don't have to do much on the 
Ultra 10, it just "is".  :-)]

Cheers,
Dave