|
Description
|
As of build 107, if "snoop" is issued with no arguments, it defaults to
loopback:
# snoop
Using device lo0 (promiscuous mode)
This is due to an environmental change and exposure of a latent bug:
* Clearview IP Observability devices went into build 103, providing
support for /dev/lo0 (and more). As a result, it is now possible
for snoop to open /dev/lo0.
* Clearview IPMP went into build 107, and simplified the interface
flags check in snoop_capture.c from IFF_VIRTUAL|IFF_LOOPBACK to just
IFF_LOOPBACK. Since loopback interfaces always have IFF_VIRTUAL
set, this seems reasonable on its face. However, since snoop uses
SIOCGIFFLAGS (rather than SIOCGLIFFLAGS) and since IFF_VIRTUAL is in
the high-order bits, it cannot be seen. That is, the IFF_VIRTUAL
check has never done anything, which the removal of IFF_LOOPBACK
exposed.
This needs to be fixed.
|