[prev in list] [next in list] [prev in thread] [next in thread] 

List:       tcpdump-workers
Subject:    Re: [tcpdump-workers] tcpdump failing with address errors
From:       Guy Harris <guy () alum ! mit ! edu>
Date:       2005-12-08 3:06:04
Message-ID: 4A389824-C64A-476C-BAA1-86973EA864FB () alum ! mit ! edu
[Download RAW message or body]


On Dec 7, 2005, at 5:37 PM, Rebekah Taylor wrote:

> However tcpdump has fallen over a few times with either of the  
> follwing
> errors
>
>             tcpdump: read: A memory address is not in the address  
> space
> for the process
>
>             tcpdump: read: Bad address
>
> Do you know what causes this failure

It's apparently caused by the fact that AIX's BPF implementation is  
buggy.  Nobody's managed to figure out whether there's a way to avoid  
this; the current release of libpcap works around it by ignoring  
those errors and trying again.

Are you using tcpdump.org's or AIX's tcpdump?  If it's AIX's tcpdump,  
complain to IBM and ask them to fix their BPF implementation.  If  
it's our tcpdump, did you build it with our libpcap, or with the one  
from AIX 5.x (4.x doesn't come with libpcap)?  If it's built with out  
libpcap, what version is it built with?  (What does "tcpdump -h"  
print?)  If it's built with AIX's libpcap, do you have the same  
problem with AIX's tcpdump?  (If so, see above.)

> and how to avoid it?

Avoid it by avoiding AIX, at least if you're trying to capture  
network traffic. :-)

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
[prev in list] [next in list] [prev in thread] [next in thread]