ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] tshark fails to capture packet on IB interface

From: Joerg Mayer <jmayer@xxxxxxxxx>
Date: Wed, 20 Sep 2006 11:43:34 +0200
On Wed, Sep 20, 2006 at 12:32:04AM -0700, Guy Harris wrote:
> Guy Harris wrote:
> 
> > No, because I don't have the Linux kernel source handy at present, but  
> > what you want to do is edit net/core/dev.c, look for "case  
> > SIOCGIFHWADDR:" somewhere around line 2362, and change the code to do
> 
> Actually, the existing code already refuses to copy more than "sizeof 
> ifr->ifr_hwaddr.sa_data" bytes, so you might just want to take the patch at
> 
> 	http://oss.oracle.com/projects/rhel4kernels/src/mainline/current/SOURCES/linux-2.6.9-net-SIOCGIFHWADDR-NULL-dev_addr.patch
> 
> and apply it to the Linux kernel with "patch -R", to back that patch out.
> 
> If you're ambitious, you could then change the code to
> 
> 		case SIOCGIFHWADDR:
> 			if (!dev->addr_len)
> 				memset(ifr->ifr_hwaddr.sa_data, 0, sizeof ifr->ifr_hwaddr.sa_data);
> 			else
> 				memcpy(ifr->ifr_hwaddr.sa_data, dev->dev_addr,
> 				       min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
> 			ifr->ifr_hwaddr.sa_family = dev->type;
> 			return 0;
> 
> (so as not to lose the "memset()").
> 
> Or just upgrade to a more recent kernel, such as 2.6.10, which *already* 
> works like that - but don't pick up Red Hat's change that caused the 
> ioctl to return an error.

Could you open a bug for that, put in your comments and close it as
invalid. That way we may point further people to that bug.

 Ciao
    Joerg
-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.