Ask Your Question

couldn't attach dumpcap to my own defined device

asked 2023-06-06 15:18:01 +0000

da5id gravatar image

updated 2023-06-06 16:01:37 +0000

grahamb gravatar image

Hello out there, a while ago I defined my own device with a kernel module. Within libpcap I defined my own set of functions, for interrogation of data over mmap or read function. It works and already tested with tcpdump. But failed when I try to bind it with dumpcap. I downloaded the wireshark sources and build it with my version of libpcap (at least I hope I did it so). Then I enoked dumpcap from the build directory of wireshark run/dumpcap -i kpmode0. When I start it with just "run/dumpcap -D" it lists among other interfaces, also my own creation. So it recognizes it. But cannot handle it. My Dumpcap version does not know my pcap functions since I cannot set breakpoints on them with gdb. On the other side if I list up the libraries which are used by this dumcap version of mine (by ldd), it lists my very own libpcap library:

chris@rockpro64:~/wireshark_build$ ldd run/dumpcap (0x0000ffffaae4d000) => /usr/local/lib/ (0x0000ffffaad82000) => /lib/aarch64-linux-gnu/ (0x0000ffffaad58000) => /lib/aarch64-linux-gnu/ (0x0000ffffaac15000) => /lib/aarch64-linux-gnu/ (0x0000ffffaac01000) => /lib/aarch64-linux-gnu/ (0x0000ffffaab6f000) => /lib/aarch64-linux-gnu/ (0x0000ffffaa9fb000) => /lib/aarch64-linux-gnu/ (0x0000ffffaa9e4000) => /lib/aarch64-linux-gnu/ (0x0000ffffaa9b2000)
    /lib/ (0x0000ffffaae1d000) => /lib/aarch64-linux-gnu/ (0x0000ffffaa940000) => /lib/aarch64-linux-gnu/ (0x0000ffffaa90f000) => /lib/aarch64-linux-gnu/ (0x0000ffffaa8fb000)

And within this /usr/local/lib/ I can see my kpmode functions:

chris@rockpro64:~/wireshark_build$ nm -a /usr/local/lib/ | grep kpmode
0000000000000000 a pcap-kpmode.c
000000000000a8f0 t kpmode_activate
000000000000ac40 t kpmode_create
000000000000aba0 t kpmode_findalldevs
000000000000a8b0 t kpmode_inject_linux
000000000000aa80 t kpmode_read_linux_bin
000000000000a8a0 t kpmode_setdirection_linux

So why I cannot bring them together?

Thank you in advance

BR /chris

edit retag flag offensive close merge delete


Did you have a look at the libpcap functions used by dumpcap vs those used by tcpdump?

Jaap gravatar imageJaap ( 2023-06-06 17:42:25 +0000 )edit

But cannot handle it.

What are the details of what happens if you try to tell dumpcap to capture on your interface?

Guy Harris gravatar imageGuy Harris ( 2023-06-06 23:02:25 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2023-06-19 12:50:18 +0000

da5id gravatar image

It was my fault, to expact that the libpcap symbols are already known right from the start of dumpcap with gdb. But these symbols are getting only imported after loading the library. I was confused by Tcpdump, because Tcpdump loads libpcap statically, and has all my self defined symbols and functions at dispose right after the start of gdb. So my expectation was wrong here. With Dumpcap I can define the breakpoints at my functions and after loading the library the debugger stops there. Thank you for your help anyway

BR /chris

edit flag offensive delete link more


Tcpdump loads libpcap statically

What do you mean by "loads libpcap statically"? From "/usr/local/lib/", I infer that this is neither Windows nor macOS nor AIX, so I'll take a look at, for example, Ubuntu 22.04:

ubu22-04$ ldd /bin/tcpdump (0x00007fff6db7f000) => /lib/x86_64-linux-gnu/ (0x00007fc176800000) => /lib/x86_64-linux-gnu/ (0x00007fc1771ac000)


It's linked dynamically, although it's not "loaded dynamically" in the sense of calling dlopen() to load it at runtime.

Guy Harris gravatar imageGuy Harris ( 2023-06-19 18:38:40 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2023-06-06 15:18:01 +0000

Seen: 146 times

Last updated: Jun 19 '23