1Using BPF: 2 3(1) AIX 4.x's version of BPF is undocumented and somewhat unstandard; the 4 current BPF support code includes changes that should work around 5 that; it appears to compile and work on at least one AIX 4.3.3 6 machine. 7 8 Note that the BPF driver and the "/dev/bpf" devices might not exist 9 on your machine; AIX's tcpdump loads the driver and creates the 10 devices if they don't already exist. Our libpcap should do the 11 same, and the configure script should detect that it's on an AIX 12 system and choose BPF even if the devices aren't there. 13 14(2) If libpcap doesn't compile on your machine when configured to use 15 BPF, or if the workarounds fail to make it work correctly, you 16 should send to tcpdump-workers@lists.tcpdump.org a detailed bug 17 report (if the compile fails, send us the compile error messages; 18 if it compiles but fails to work correctly, send us as detailed as 19 possible a description of the symptoms, including indications of the 20 network link-layer type being wrong or time stamps being wrong). 21 22 If you fix the problems yourself, please submit a patch by forking 23 the branch at 24 25 https://github.com/the-tcpdump-group/libpcap/issues 26 27 and issuing a pull request, so we can incorporate the fixes into the 28 next release. 29 30 If you don't fix the problems yourself, you can, as a workaround, 31 make libpcap use DLPI instead of BPF. 32 33 This can be done by specifying the flag: 34 35 --with-pcap=dlpi 36 37 to the "configure" script for libpcap. 38 39If you use DLPI: 40 41(1) It is a good idea to have the latest version of the DLPI driver on 42 your system, since certain versions may be buggy and cause your AIX 43 system to crash. DLPI is included in the fileset bos.rte.tty. I 44 found that the DLPI driver that came with AIX 4.3.2 was buggy, and 45 had to upgrade to bos.rte.tty 4.3.2.4: 46 47 lslpp -l bos.rte.tty 48 49 bos.rte.tty 4.3.2.4 COMMITTED Base TTY Support and Commands 50 51 Updates for AIX filesets can be obtained from: 52 ftp://service.software.ibm.com/aix/fixes/ 53 54 These updates can be installed with the smit program. 55 56(2) After compiling libpcap, you need to make sure that the DLPI driver 57 is loaded. Type: 58 59 strload -q -d dlpi 60 61 If the result is: 62 63 dlpi: yes 64 65 then the DLPI driver is loaded correctly. 66 67 If it is: 68 69 dlpi: no 70 71 Then you need to type: 72 73 strload -f /etc/dlpi.conf 74 75 Check again with strload -q -d dlpi that the dlpi driver is loaded. 76 77 Alternatively, you can uncomment the lines for DLPI in 78 /etc/pse.conf and reboot the machine; this way DLPI will always 79 be loaded when you boot your system. 80 81(3) There appears to be a problem in the DLPI code in some versions of 82 AIX, causing a warning about DL_PROMISC_MULTI failing; this might 83 be responsible for DLPI not being able to capture outgoing packets. 84