From mh+dsc at zugschlus.de Tue Sep 14 07:41:20 2010 From: mh+dsc at zugschlus.de (Marc Haber) Date: Tue, 14 Sep 2010 09:41:20 +0200 Subject: [dsc] dsc listening on multiple interfaces Message-ID: <20100914074120.GB20107@torres.zugschlus.de> Hi, I am trying to have dsc listen on two interfaces. This is my config: local_address 127.0.0.1; local_address ::1; local_address 192.168.18.22; local_address fe80::5054:ff:fe28:219a; run_dir "/var/lib/dsc"; minfree_bytes 5000000; pid_file "/var/run/dsc/dsc.pid"; interface lo; interface eth0; In the final configuration, I will listen on eth0 and eth1; the target system is going to have like 30 IP addresses. My current test box is much simpler, which is the reason why I am listening on lo. My system is running Debian lenny (kernel 2.6.26, libpcap 0.9.8). First, I notice that I only have a single dsc process running while the docs say that there will be two. Second, I see that dsc is not writing out any data, and strace shows that it sits tight on a "recvfrom(4,", while FD 4 is the socket opened on lo. When I send a query on lo, the process gets moving, but it isn't when the query comes in on eth0. I am by no means a programmer, but shouldn't dsc use a non-blocking syscall to read from the interface if it is listening on more than one interface? Am I doing something wrong? Any hints will be appreciated. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 3221 2323190 From wessels at measurement-factory.com Tue Sep 14 15:44:42 2010 From: wessels at measurement-factory.com (Duane Wessels) Date: Tue, 14 Sep 2010 09:44:42 -0600 (MDT) Subject: [dsc] dsc listening on multiple interfaces In-Reply-To: <20100914074120.GB20107@torres.zugschlus.de> References: <20100914074120.GB20107@torres.zugschlus.de> Message-ID: On Tue, 14 Sep 2010, Marc Haber wrote: > I am by no means a programmer, but shouldn't dsc use a non-blocking > syscall to read from the interface if it is listening on more than one > interface? Am I doing something wrong? Hi Marc, I don't think you're doing anything wrong. Probably nobody noticed this bug before because anyone that used muiltiple interfaces probably had "busy" interfaces. Please try the attached patch. DW -------------- next part -------------- Index: collector/dsc/pcap.c =================================================================== --- collector/dsc/pcap.c (revision 12435) +++ collector/dsc/pcap.c (working copy) @@ -997,6 +997,10 @@ syslog(LOG_ERR, "pcap_open_*: %s", errbuf); exit(1); } + if (pcap_setnonblock(i->pcap, 1, errbuf) < 0) { + syslog(LOG_ERR, "pcap_setnonblock(%s): %s", device, errbuf); + exit(1); + } memset(&fp, '\0', sizeof(fp)); x = pcap_compile(i->pcap, &fp, bpf_program_str, 1, 0); if (x < 0) { From mh+dsc at zugschlus.de Fri Sep 17 13:40:41 2010 From: mh+dsc at zugschlus.de (Marc Haber) Date: Fri, 17 Sep 2010 15:40:41 +0200 Subject: [dsc] dsc listening on multiple interfaces In-Reply-To: References: <20100914074120.GB20107@torres.zugschlus.de> Message-ID: <20100917134041.GC10123@torres.zugschlus.de> On Tue, Sep 14, 2010 at 09:44:42AM -0600, Duane Wessels wrote: > On Tue, 14 Sep 2010, Marc Haber wrote: >> I am by no means a programmer, but shouldn't dsc use a non-blocking >> syscall to read from the interface if it is listening on more than one >> interface? Am I doing something wrong? > > I don't think you're doing anything wrong. Probably nobody noticed > this bug before because anyone that used muiltiple interfaces probably > had "busy" interfaces. > > Please try the attached patch. That does seem to do the trick just fine. Thanks for the fast help, I appreciate that. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 3221 2323190