[Winpcap-users] winpcap nuked my interface ? [on behalf of Carlos G Mendioroz]

[Carlos G Mendioroz]

Gianluca Varenni @ 1/12/2010 19:06 -0300 dixit:
> WinPcap works on top of the network card drivers and does not have any control 
 > over the hardware itself.

I presumed that, but what is very strange is that the same behaviour 
happened at the same time on two different drivers!

> 
> From what you say, you are running WinPcap in a QEMU virtual machine 
 >(which I've never tested. I've extensively used WinPcap from within 
vmware).
 >I don't know what the "juniper patch" is.

I don't think my explanation was clear enough. My host is a windows 2003 
server machine with many network cards.
I was using qemu to host an IPS image (cisco 4215) for training. I was
trying to let the guest (IPS) access 3 of my interfaces using winpcap.

Qemu does not support pcap based nic attachments. The "juniper pacth" 
adds a couple of features including pcap NICs. (Used to run so called
Olives, i.e., Juniper router code inside an emulated hardware)

> 
> What other networking software do you have in this virtual machine? 
 > Do you have some VPN/firewall or similar software installed?
 > Which version of Windows? Which version of WinPcap?

As explained, the host is not a VM, the guest is AFAIK irrelevant ? But
it is cisco IPS 6.0.1. No firewall at the host. Winpcap 4.0.2.

The quad PRO/100 has direct links to a cisco 2950, the affected ports do 
not link up now (nor the atheros) even while the machine is under BIOS
control after cold reboot. So whatever it is, is kind of permanent.

I was guessing some media type change would do that, but I don't know
if this is even supported... I'm at loss :(

> 
> Have a nice day
> GV

Hardly for the time being. Thanks for the repost!
-Carlos
> 
> -----Original Message-----
> From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
> Sent: Wednesday, December 01, 2010 1:56 PM
> To: winpcap-users at winpcap.org
> Cc: tron at acm.org
> Subject: [Winpcap-users] winpcap nuked my interface ? [on behalf of Carlos G Mendioroz]
> 
> [On behalf of Carlos G Mendioroz, for some unknown reason his messages don't get thru our mailing list server]
> 
> I've run into a strange issue: soon after loading a program that uses pcap, the three interfaces I was trying to attach to reported "cable disconnected".
> 
> I thought it was a parameters issue, but I've found that whatever went wrong, it has been made persistent at the hardware level! :(
> 
> I.e. the interfaces htat I was trying to use do not get link up now even as the machine is doint POST. I've 1 atheros gigabit if, and 4 intel pro/100 ifs. The other 2 intel ports run fine.
> 
> So question: what can possibly a program do using pcap that can force an interface to stay link down (i.e. no carrier) that is saved to the firmware ?
> 
> If it matters, the client is qemu 0.11.0 with juniper patch, which adds pcap support.
> 
> Any pointer is more than welcome!
> Thanks in advance,
> Carlos G Mendioroz
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users

-- 
Carlos G Mendioroz  <tron at huapi.ba.ar>  LW7 EQI  Argentina