Re: libpcap fix (Re: nmap port)

[Larry Creech <lcreech gpspc-lcc comsys rockwell com>]

I've also had problems with RH6.0 libpcap, and arpwatch. 

Dec  5 04:04:05 gpspc-lcc arpwatch: short (want 42)
Dec  5 04:04:37 gpspc-lcc last message repeated 55 times
Dec  5 04:05:39 gpspc-lcc last message repeated 163 times
Dec  5 04:06:40 gpspc-lcc last message repeated 92 times
Dec  5 04:07:42 gpspc-lcc last message repeated 125 times
Dec  5 04:08:43 gpspc-lcc last message repeated 102 times

Recompiled both, but had to remove "-DHAVE_DN_SKIPNAME=1" from arpwatch's
Makefile get arpwatch to compile.


On Tue, 7 Dec 1999, Dan Frasnelli wrote:

> > It should work fine now.  No more seg faults.
> > www.insecure.org/nmap
> 
> Excellent work, Mark.  I'm sure everyone here that does network security
> will buy you a beverage at some time in the future ;-) 
> 
> Few weeks back, I posted something to this list about fixing libpcap
> under Linux/axp.  To recap, here are the issues I (and probably anyone 
>  else trying to use the redhat pcap packages) encountered:
> - failure to read capturefiles collected on non-Linux/axp platforms
> - applications linked to libpcap segfault on mmap() calls; most of my
>   security/net analysis stuff was useless on my personal boxes. 
> 
> Came up with a working solution but have not found the time to determine
> "why".  The libpcap and tcpdump sources provided with debian work with
> linux/axp; I've tested the snort NIDS, tcpflow, tcptrace, and some
> homebrew code that uses pcap - no problems as of yet. 
> 
> >From your local debian mirror, grab: 
> /debian/dists/stable/main/source/libs/libpcap_0.4a6.orig.tar.gz
> /debian/dists/stable/main/source/libs/libpcap_0.4a6-2.1.diff.gz 
> 
> (and if you want a working tcpdump)
> /debian/dists/stable/main/source/net/tcpdump_3.4a6.orig.tar.gz
> /debian/dists/stable/main/source/net/tcpdump_3.4a6-3.diff.gz
> 
> Alternatively, you can grab the 'alien' tool and convert the binary
> .deb packages to tgz/rpm/your preferred format.  
> 
> --
> Dan Frasnelli
> Security Analyst
> 
> -- 
> To unsubscribe: send e-mail to axp-list-request@redhat.com with
> 'unsubscribe' as the subject.  Do not send it to axp-list@redhat.com
>