Re: [tcpdump-workers] localhost on Solaris

2004-08-26 Thread rick jones
my _guess_ would be you would need to write some pseudo-driver (driver, not module) that looks more or less like a NIC driver, but simply loops things back up. call it, oh, the "loop" driver. get it installed into the system and create the loop0 interface - bring lo0 down and bring 127.0.0.1

Re: [tcpdump-workers] localhost on Solaris

2004-08-24 Thread Guy Harris
ury segal wrote: OK... Assuming I insist on enabling localhost sniffing on Solaris to the benerfit of all: You might want to rephrase that as "insist on *attempting* to enable..." - there's no guarantee that you'll succeed, no matter how beneficial it'd be, as the Solaris networking code might no

Re: [tcpdump-workers] localhost on Solaris

2004-08-23 Thread ury segal
OK... Assuming I insist on enabling localhost sniffing on Solaris to the benerfit of all: How should I approach it? How about pushing a STREAMS module on top of the TCP driver? ( Is *that* a STREAMS driver nowdays?) --ury --- Rick Jones <[EMAIL PROTECTED]> wrote: > ury segal wrote: > > Thanks

Re: [tcpdump-workers] localhost on Solaris

2004-08-18 Thread Rick Jones
ury segal wrote: Thanks for the answer! There is nothing similar to ip_loopback_bypass in Solaris. The be all and end all of Unix OSes has no such thing?!? Imagine :) When I run netstat -i, I do see packets that are "passed through" the localhost interface. Is there a real entity in the kernel whi

Re: [tcpdump-workers] localhost on Solaris

2004-08-18 Thread ury segal
Thanks for the answer! There is nothing similar to ip_loopback_bypass in Solaris. When I run netstat -i, I do see packets that are "passed through" the localhost interface. Is there a real entity in the kernel which is the loopback interface, may it be a driver (seems not to be one), STREAMS mo

Re: [tcpdump-workers] localhost on Solaris

2004-08-18 Thread rick jones
The Solaris and HP-UX 11.X stacks are "cousins" so this may help, it may not... Under HP-UX, if the traffic is to a machine-local IP address, it gets looped-back in IP and never gets through DLPI into a driver and so cannot be traced with tcpdump. However, there is an "unsupported" ndd tunabl

Re: [tcpdump-workers] localhost on Solaris

2004-08-18 Thread Darren Reed
> Hi ! > > I understand there is no solution to sniffing > for local traffic on Solaris since the > kernel always used the loopback interface for > that. > > I suggest to write a STREAMS module to sit on top > of the loopback driver. > > Does anyone know if the loopback driver is a > STREAMS dr

[tcpdump-workers] localhost on Solaris

2004-08-17 Thread ury segal
Hi ! I understand there is no solution to sniffing for local traffic on Solaris since the kernel always used the loopback interface for that. I suggest to write a STREAMS module to sit on top of the loopback driver. Does anyone know if the loopback driver is a STREAMS driver ? (Say, Solaris 8 a