[realtek] Can't sniff with Realtek 8139 in HP ZT1100 series laptop
Jason Bowman
jasonb42lists@attbi.com
Mon Aug 19 10:09:55 2002
--------------Boundary-00=_H160SMWXOGB9H9A8V55X
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hello,
I have a realtek 8139 ethernet card built into my HP ZT1100 series laptop=
=2E For=20
some reason I can not sniff network traffic, something that is very usefu=
l=20
for network diagnostics where I work.=20
It seems that if the ethernet packet's are not to my ethernet address, my=
card=20
ignores them. This is not at the ip layer, as I can do an arpspoof of the=
=20
gateway and then forward the packets to the gateway.
I have been using the 8139too driver included with the kernel, however I =
have=20
also tested with the rtl8139 driver. The results seem to be the same. I h=
ave=20
attached three files which are the output of the rtl8139-diag program wit=
h=20
the rtl8139 & pci-scan modules. One is before anything, the next is after=
=20
tcpdump -p -i eth0, and the next is some time later.
Below seems to be the only time I have been able to sniff a packet. I can=
not=20
reproduce. This was just before the first after file. Note that there wa=
s a=20
continuous stream of pings, it just captured this one packet.
[root@waturu acpikernels]# tcpdump -p -i eth0
tcpdump: listening on eth0
14:22:10.213794 192.168.1.13 > 192.168.1.1: icmp: echo request (DF)
14:22:19.144572 192.168.1.13.631 > 192.168.1.255.631: udp 101 (DF)
14:22:19.144683 192.168.1.13.631 > 192.168.1.255.631: udp 98 (DF)
Note that looking at the card and hub's activity lights, my card does not=
show=20
as flashing (active) for packets that are not specifically for it, despit=
e=20
being in promisc mode.
Thank you in advance,
Jason B.
Test network:
Linksys Switch/Broadband Router (192.168.1.1) connects to=20
Linksys 4 port Hub connects to
=09Laptop (192.168.1.14)
=09Desktop (192.168.1.13) - pinging the router
--------------Boundary-00=_H160SMWXOGB9H9A8V55X
Content-Type: text/plain;
charset="us-ascii";
name="after"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="after"
rtl8139-diag.c:v2.09 8/6/2002 Donald Becker (becker@scyld.com)
http://www.scyld.com/diag/index.html
Index #1: Found a RealTek RTL8139 adapter at 0xe200.
The RealTek chip appears to be active, so some registers will not be read.
To see all register values use the '-f' flag.
RealTek chip registers at 0xe200
0x000: 353f0200 00006073 ffffffff ffffffff 8008a03c 8008a03c 8008a03c 8008a03c
0x020: 0b728010 0b728610 0b728c10 0b729210 0b720000 0d000000 0000fff0 0000c07f
0x040: 78800400 0000940f 60dba1b1 00000000 00cd1000 00000000 0088c51c 00100000
0x060: 1000f00f 01e17809 00000000 00000000 00000004 000f73c0 60f403b9 9836dfa3.
Realtek station address 00:02:3f:35:73:60, chip type 'Unknown version'.
Receiver configuration: Promiscuous
Rx FIFO threshold 256 bytes, maximum burst 256 bytes, 32KB ring
Transmitter enabled with normal settings, maximum burst 256 bytes.
Tx entry #0 status 8008a03c complete, 60 bytes.
Tx carrier lost
Tx entry #1 status 8008a03c complete, 60 bytes.
Tx carrier lost
Tx entry #2 status 8008a03c complete, 60 bytes.
Tx carrier lost
Tx entry #3 status 8008a03c complete, 60 bytes.
Tx carrier lost
Flow control: Tx disabled Rx disabled.
The chip configuration is 0x10 0xcd, MII full-duplex mode.
No interrupt sources are pending.
Decoded EEPROM contents:
PCI IDs -- Vendor 0x10ec, Device 0x8139.
PCI Subsystem IDs -- Vendor 0x103c, Device 0x0020.
PCI timer settings -- minimum grant 32, maximum latency 64.
General purpose pins -- direction 0xe5 value 0x12.
Station Address 00:02:3F:35:73:60.
Configuration register 0/1 -- 0xcd / 0xc2.
EEPROM active region checksum is 0802.
The RTL8139 does not use a MII transceiver.
It does have internal MII-compatible registers:
Basic mode control register 0x1000.
Basic mode status register 0x7809.
Autonegotiation Advertisement 0x01e1.
Link Partner Ability register 0x0000.
Autonegotiation expansion 0x0000.
Disconnects 0x0000.
False carrier sense counter 0x0000.
NWay test register 0x0004.
Receive frame error count 0x0000.
--------------Boundary-00=_H160SMWXOGB9H9A8V55X
Content-Type: text/plain;
charset="us-ascii";
name="after2"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="after2"
rtl8139-diag.c:v2.09 8/6/2002 Donald Becker (becker@scyld.com)
http://www.scyld.com/diag/index.html
Index #1: Found a RealTek RTL8139 adapter at 0xe200.
The RealTek chip appears to be active, so some registers will not be read.
To see all register values use the '-f' flag.
RealTek chip registers at 0xe200
0x000: 353f0200 00006073 ffffffff ffffffff 0008a062 0008a062 0008a03c 0008a062
0x020: 0b728010 0b728610 0b728c10 0b729210 0b720000 0d0a0000 31d031c0 0000c07f
0x040: 78800400 0000940f e7be6fc5 00000000 00cd1000 00000000 0088c510 00100000
0x060: 1100f00f 01e1782d 000145e1 00130001 00000004 000207c8 60f403b9 9836dfa3.
Realtek station address 00:02:3f:35:73:60, chip type 'Unknown version'.
Receiver configuration: Promiscuous
Rx FIFO threshold 256 bytes, maximum burst 256 bytes, 32KB ring
Transmitter enabled with normal settings, maximum burst 256 bytes.
Tx entry #0 status 0008a062 complete, 98 bytes.
Tx entry #1 status 0008a062 complete, 98 bytes.
Tx entry #2 status 0008a03c complete, 60 bytes.
Tx entry #3 status 0008a062 complete, 98 bytes.
Flow control: Tx disabled Rx disabled.
The chip configuration is 0x10 0xcd, MII full-duplex mode.
No interrupt sources are pending.
Decoded EEPROM contents:
PCI IDs -- Vendor 0x10ec, Device 0x8139.
PCI Subsystem IDs -- Vendor 0x103c, Device 0x0020.
PCI timer settings -- minimum grant 32, maximum latency 64.
General purpose pins -- direction 0xe5 value 0x12.
Station Address 00:02:3F:35:73:60.
Configuration register 0/1 -- 0xcd / 0xc2.
EEPROM active region checksum is 0802.
The RTL8139 does not use a MII transceiver.
It does have internal MII-compatible registers:
Basic mode control register 0x1100.
Basic mode status register 0x782d.
Autonegotiation Advertisement 0x01e1.
Link Partner Ability register 0x45e1.
Autonegotiation expansion 0x0001.
Disconnects 0x0000.
False carrier sense counter 0x0000.
NWay test register 0x0004.
Receive frame error count 0x0000.
--------------Boundary-00=_H160SMWXOGB9H9A8V55X
Content-Type: text/plain;
charset="us-ascii";
name="before"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="before"
rtl8139-diag.c:v2.09 8/6/2002 Donald Becker (becker@scyld.com)
http://www.scyld.com/diag/index.html
Index #1: Found a RealTek RTL8139 adapter at 0xe200.
The RealTek chip appears to be active, so some registers will not be read.
To see all register values use the '-f' flag.
RealTek chip registers at 0xe200
0x000: 353f0200 00006073 80000000 00000000 8008a03c 8008a03c 8008a03c 8008a03c
0x020: 0b728010 0b728610 0b728c10 0b729210 0b720000 0d000000 0000fff0 0000c07f
0x040: 78800400 0000940e 42e1d5e1 00000000 00cd1000 00000000 0088c51c 00100000
0x060: 1000f00f 01e17809 00000000 00000000 00000004 000f73c0 60f403b9 9836dfa3.
Realtek station address 00:02:3f:35:73:60, chip type 'Unknown version'.
Receiver configuration: Normal unicast and hashed multicast
Rx FIFO threshold 256 bytes, maximum burst 256 bytes, 32KB ring
Transmitter enabled with normal settings, maximum burst 256 bytes.
Tx entry #0 status 8008a03c complete, 60 bytes.
Tx carrier lost
Tx entry #1 status 8008a03c complete, 60 bytes.
Tx carrier lost
Tx entry #2 status 8008a03c complete, 60 bytes.
Tx carrier lost
Tx entry #3 status 8008a03c complete, 60 bytes.
Tx carrier lost
Flow control: Tx disabled Rx disabled.
The chip configuration is 0x10 0xcd, MII full-duplex mode.
No interrupt sources are pending.
Decoded EEPROM contents:
PCI IDs -- Vendor 0x10ec, Device 0x8139.
PCI Subsystem IDs -- Vendor 0x103c, Device 0x0020.
PCI timer settings -- minimum grant 32, maximum latency 64.
General purpose pins -- direction 0xe5 value 0x12.
Station Address 00:02:3F:35:73:60.
Configuration register 0/1 -- 0xcd / 0xc2.
EEPROM active region checksum is 0802.
The RTL8139 does not use a MII transceiver.
It does have internal MII-compatible registers:
Basic mode control register 0x1000.
Basic mode status register 0x7809.
Autonegotiation Advertisement 0x01e1.
Link Partner Ability register 0x0000.
Autonegotiation expansion 0x0000.
Disconnects 0x0000.
False carrier sense counter 0x0000.
NWay test register 0x0004.
Receive frame error count 0x0000.
--------------Boundary-00=_H160SMWXOGB9H9A8V55X--