It would be more accurate to say that it allows only one promiscuous mode stream per interface.
And that's exactly what the problem was - I was inadvertently calling pcap_open_live twice on the same interface. It didn't occur to me to even look for that, as I was under the impression that the DLPI restriction on HP-UX only concerned more than one process opening a promiscuous mode stream (not a single process opening two promiscuous mode streams). Easy fix - thanks for your help. Justin - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
