[Winpcap-users] winpcap nuked my interface ? [on behalf of Carlos G Mendioroz]

[Carlos G Mendioroz]

To close the issue (FTR), the thing was not persistent on the host side!
The issue was caused by somehow short circuiting the three interfaces 
involved (i.e. packets arriving on one interface were copied to the 
other two). This was perceived by the 2950 that in turn disabled them.

I should have spotted this, but I did not :(

-Carlos

Gianluca Varenni wrote:
> I've seen something similar once on a machine with Intel cards, and the solution was to reinstall the Intel drivers through the intel driver CD. I never discovered what caused that. 
> 
> Have a nice day
> GV 
> 
> -----Original Message-----
> From: Carlos G Mendioroz [mailto:tron at huapi.ba.ar] 
> Sent: Wednesday, December 01, 2010 2:25 PM
> To: Gianluca Varenni
> Cc: winpcap-users at winpcap.org
> Subject: Re: [Winpcap-users] winpcap nuked my interface ? [on behalf of Carlos G Mendioroz]
> 
> Gianluca Varenni @ 1/12/2010 19:06 -0300 dixit:
>> WinPcap works on top of the network card drivers and does not have any 
>> control
>  > over the hardware itself.
> 
> I presumed that, but what is very strange is that the same behaviour happened at the same time on two different drivers!
> 
>> From what you say, you are running WinPcap in a QEMU virtual machine
>  >(which I've never tested. I've extensively used WinPcap from within vmware).
>  >I don't know what the "juniper patch" is.
> 
> I don't think my explanation was clear enough. My host is a windows 2003 server machine with many network cards.
> I was using qemu to host an IPS image (cisco 4215) for training. I was trying to let the guest (IPS) access 3 of my interfaces using winpcap.
> 
> Qemu does not support pcap based nic attachments. The "juniper pacth" 
> adds a couple of features including pcap NICs. (Used to run so called Olives, i.e., Juniper router code inside an emulated hardware)
> 
>> What other networking software do you have in this virtual machine? 
>  > Do you have some VPN/firewall or similar software installed?
>  > Which version of Windows? Which version of WinPcap?
> 
> As explained, the host is not a VM, the guest is AFAIK irrelevant ? But it is cisco IPS 6.0.1. No firewall at the host. Winpcap 4.0.2.
> 
> The quad PRO/100 has direct links to a cisco 2950, the affected ports do not link up now (nor the atheros) even while the machine is under BIOS control after cold reboot. So whatever it is, is kind of permanent.
> 
> I was guessing some media type change would do that, but I don't know if this is even supported... I'm at loss :(
> 
>> Have a nice day
>> GV
> 
> Hardly for the time being. Thanks for the repost!
> -Carlos
>> -----Original Message-----
>> From: winpcap-users-bounces at winpcap.org 
>> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca 
>> Varenni
>> Sent: Wednesday, December 01, 2010 1:56 PM
>> To: winpcap-users at winpcap.org
>> Cc: tron at acm.org
>> Subject: [Winpcap-users] winpcap nuked my interface ? [on behalf of 
>> Carlos G Mendioroz]
>>
>> [On behalf of Carlos G Mendioroz, for some unknown reason his messages 
>> don't get thru our mailing list server]
>>
>> I've run into a strange issue: soon after loading a program that uses pcap, the three interfaces I was trying to attach to reported "cable disconnected".
>>
>> I thought it was a parameters issue, but I've found that whatever went 
>> wrong, it has been made persistent at the hardware level! :(
>>
>> I.e. the interfaces htat I was trying to use do not get link up now even as the machine is doint POST. I've 1 atheros gigabit if, and 4 intel pro/100 ifs. The other 2 intel ports run fine.
>>
>> So question: what can possibly a program do using pcap that can force an interface to stay link down (i.e. no carrier) that is saved to the firmware ?
>>
>> If it matters, the client is qemu 0.11.0 with juniper patch, which adds pcap support.
>>
>> Any pointer is more than welcome!
>> Thanks in advance,
>> Carlos G Mendioroz
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
> 
> --
> Carlos G Mendioroz  <tron at huapi.ba.ar>  LW7 EQI  Argentina

-- 
Carlos G Mendioroz  <tron at huapi.ba.ar>  LW7 EQI  Argentina