                         Network library lcrzo

              -------------------------------------------
              |          PROBLEMS AND SOLUTIONS         |
              -------------------------------------------

Problems described in this file are (if you encounter an unknown problem,
thanks for contacting me, as described at the end of this file) :


WHILE EXECUTING ./GENEMAKE
 1: exec ether_hostton ko
       Warning: you are on a computer with a bad ether_hostton.
                The library lcrzo will still be usable, but read 
                ../doc/problemssolutionsunix_en.txt if you want to use the file
                /etc/ethers.
    [problem in /etc/nsswitch.conf]
 2: exec ether_hostton ko
       Warning: you are on a computer with a bad ether_hostton.
                The library lcrzo will still be usable, but read 
                ../doc/problemssolutionsunix_en.txt if you want to use the file
                /etc/ethers.
    [problem in /etc/ethers]
 3: ./genemake : Permission denied.
 4: Error: the xx directory '/usr/.../toto' doesn't exists.
 5: Error: the library libpcap is not installed.
 6: config.verif.tmp.c: pcap.h: No such file or directory.
 7: pcap.h: net/bpf.h: No such file or directory.
 8: /usr/bin/ld: cannot find -lpcap.

WHILE COMPILING
 9: Warning : integer constant is unsigned in ANSI C, signed with -traditional.
10: Warning : implicit declaration of function `ether_hostton'.
11: Error : /usr/include/linux/xxx.h: No such file or directory
    Error : /usr/include/asm/xxx.h: No such file or directory
    Error : linux/xxx.h: No such file or directory
    Error : asm/xxx.h: No such file or directory
12: Warning : SIG_IGN : function declaration isn't a prototype
    Warning : SIG_DFL : function declaration isn't a prototype
    Warning : SIG_xxx : function declaration isn't a prototype
13: Warning in /usr/include/bits/string2.h

WHILE EXECUTING
14: Segmentation fault while converting from IP address to ethernet
    address. [problem in /etc/nsswitch.conf]
15: Segmentation fault while converting from IP address to ethernet
    address. [problem in /etc/ethers]
16: Lcrzo is slow.

WHILE SNIFFING
17: Linux : Display of "linux socket: Too many open files" while calling exit().
18: Linux : Display of "kernel: program uses obsolete (PF_INET,SOCK_PACKET)"
    in "/var/log/messages". This is a warning only.
19: FreeBSD : cannot sniff.
20: FreeBSD : /dev/bpfii: Device not configured.
21: FreeBSD : /dev/bpfii: No such file or directory.
22: Linux : The computer local's address is added and the end of an IP option
    of type "record route" or "timestamp".
23: Linux : The sniff doesn't work.
24: Linux : Display of an error in module net-pf-17 in /var/log/messages.

WHILE SPOOFING
25: While spoofing at IP level, some packets refuse to be emitted.
26: While spoofing at IP level, some packets emitted doesn't have the 
    same values in the header that the ones we specified.
27: Error 1001 : error in sendto()
28: Linux : When we send a lot of packets at IP level (with lcrzo_sendraw_ip, 
    lcrzo_sendpacket_ipxxx, etc.), there is a saturation of the system.
29: FreeBSD : cannot spoof.
30: FreeBSD : /dev/bpfii: Device not configured.
31: FreeBSD : /dev/bpfii: No such file or directory.
32: xBSD : Packets emitted to the network always have the ethernet address of
    the board, instead of having the address specified in the packet.



-------------------------------------------------------------------------------
Problem 1 :
  Problem synthesis :
    exec ether_hostton ko
       Warning: you are on a computer with a bad ether_hostton.
                The library lcrzo will still be usable, but read 
                ../doc/problemssolutionsunix_en.txt if you want to use the file
                /etc/ethers.
    [problem in /etc/nsswitch.conf]
  Environment affected by the problem :
    Glibc-2.?? (<2.2.1) with "nisplus" or "db" in /etc/nsswitch.conf
  What's causing the problem :
    The problem arises when calling the function ether_hostton, and when
    the entry "nisplus" or "db" is in /etc/nsswitch.conf.
    Indeed, there is an error in glibc source (glibc-2.1.3) :
      nis/nss_nisplus/nisplus-ethers.c, line 234 : 
        there is "if (name != NULL)" instead of "if (name == NULL)"
    Note : an email was sent to glibc developers. They applied a patch
           in glibc 2.2.1.
  Solution 1 :
    Edit /etc/nsswitch.conf to replace the line :
         ethers: _here_nisplus_or_nis_or_db_is_written_ files
    by :
         ethers: files
    Indeed, the problems disappears when removing "nis", "nisplus" or "db".
    You should then execute "genemake" again (and compile and install)
    to ensure that lcrzo will use ether_hostton.
  Solution 2 :
    Install glibc > 2.2.1.

-------------------------------------------------------------------------------
Problem 2 :
  Problem synthesis :
    exec ether_hostton ko
       Warning: you are on a computer with a bad ether_hostton.
                The library lcrzo will still be usable, but read 
                ../doc/problemssolutionsunix_en.txt if you want to use the file
                /etc/ethers.
    [problem in /etc/ethers]
  Environment affected by the problem :
    /etc/ethers empty
  What's causing the problem :
    The problem arises when /etc/ethers exists, but is empty.
    Indeed, there is an error in glibc source (glibc-2.1.3) :
      inet/ether_hton.c, line 76 :
        fct has only four parameters, instead of five
    Note : an email was sent to glibc developers. They applied a patch
           in glibc 2.2.1.
  Solution 1 :
    Remove the file /etc/ethers if it doesn't contain any line.
  Solution 2 :
    Install glibc > 2.2.1.

-------------------------------------------------------------------------------
Problem 3 :
  Problem synthesis :
    ./genemake : Permission denied.
  Environment affected by the problem :
    All
  What's causing the problem :
    lcrzo-4.xx-src.tgz wasn't uncompressed with a good program.
  Solution :
    Use :
         tar -zxvf lcrzo-4.xx-src.tgz
    or
         gunzip lcrzo-4.xx-src.tgz ; tar -xvf lcrzo-4.xx-src.tar

-------------------------------------------------------------------------------
Problem 4 :
  Problem synthesis :
    Error: the xx directory '/usr/.../toto' doesn't exists.
  Environment affected by the problem :
    All
  What's causing the problem :
    The directory named 'toto' does not exist on your system.
  Solution 1 :
    Create the directory with :
         mkdir /usr/.../toto
  Solution 2 :
    Edit ../src/genemake to specify a new installation directory.

-------------------------------------------------------------------------------
Problem 5 :
  Problem synthesis :
    Error: the library libpcap is not installed.
  Environment affected by the problem :
    All
  What's causing the problem :
    The library libpcap doesn't seem to be installed
  Solution 1 :
    Libpcap isn't completely installed or configured
    Install it from http://www.tcpdump.org/.
  Solution 2 :
    Verify that all packages are installed on your system.
    For example, for Debian, you have to install libpcapxx.deb
    (for the dynamic library) and libpcap-devxx.deb (for pcap.h).
  Solution 3 :
    [if the error is about pcap.h]
    The file pcap.h is not located in a good directory :
        locate "pcap.h"
    If you find it in /somewhere/pcap.h, then link it :
        ln -s /somewhere/pcap.h /usr/local/include/pcap.h
    Note : "/usr/local/include/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/include/" for example.
  Solution 4 :
    [if the error is about bpf.h]
    The file bpf.h is not located in a good directory :
         locate "bpf.h"
    If you find it in /somewhere/bpf.h, then link it :
         ln -s /somewhere/bpf.h /usr/local/include/net/bpf.h
    Note : "/usr/local/include/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/include/" for example.
  Solution 5 :
    [if the error is about bpf.h]
    The file /usr/local/include/net/bpf.h or /usr/include/net/bpf.h
    is not on your system.
    Search the cdrom of your distribution to find the file "bpf.h",
    and install the corresponding missing package.
  Solution 6 :
    [if the error is about -lpcap]
    The file libpcap.a/libpcap.so is not located in a good directory :
        locate "libpcap.a" ; locate "libpcap.so"
    If you find it in /somewhere/libpcap.a_or_so, then link it :
        ln -s /somewhere/libpcap.a /usr/local/lib/libpcap.a
        ln -s /somewhere/libpcap.so /usr/local/lib/libpcap.so
    Note : "/usr/local/lib/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/lib/" for example.

-------------------------------------------------------------------------------
Problem 6 :
  Problem synthesis :
    config.verif.tmp.c: pcap.h: No such file or directory.
  Environment affected by the problem :
    All
  What's causing the problem :
    The library libpcap doesn't seem to be installed
  Solution 1 :
    Libpcap isn't completely installed or configured
    Install it from http://www.tcpdump.org/.
  Solution 2 :
    Verify that all packages are installed on your system.
    For example, for Debian, you have to install libpcapxx.deb
    (for the dynamic library) and libpcap-devxx.deb (for pcap.h).
  Solution 3 :
    [if the error is about pcap.h]
    The file pcap.h is not located in a good directory :
        locate "pcap.h"
    If you find it in /somewhere/pcap.h, then link it :
        ln -s /somewhere/pcap.h /usr/local/include/pcap.h
    Note : "/usr/local/include/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/include/" for example.
  Solution 4 :
    [if the error is about bpf.h]
    The file bpf.h is not located in a good directory :
         locate "bpf.h"
    If you find it in /somewhere/bpf.h, then link it :
         ln -s /somewhere/bpf.h /usr/local/include/net/bpf.h
    Note : "/usr/local/include/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/include/" for example.
  Solution 5 :
    [if the error is about bpf.h]
    The file /usr/local/include/net/bpf.h or /usr/include/net/bpf.h
    is not on your system.
    Search the cdrom of your distribution to find the file "bpf.h",
    and install the corresponding missing package.
  Solution 6 :
    [if the error is about -lpcap]
    The file libpcap.a/libpcap.so is not located in a good directory :
        locate "libpcap.a" ; locate "libpcap.so"
    If you find it in /somewhere/libpcap.a_or_so, then link it :
        ln -s /somewhere/libpcap.a /usr/local/lib/libpcap.a
        ln -s /somewhere/libpcap.so /usr/local/lib/libpcap.so
    Note : "/usr/local/lib/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/lib/" for example.

-------------------------------------------------------------------------------
Problem 7 :
  Problem synthesis :
    pcap.h: net/bpf.h: No such file or directory.
  Environment affected by the problem :
    All
  What's causing the problem :
    The library libpcap doesn't seem to be installed
  Solution 1 :
    Libpcap isn't completely installed or configured
    Install it from http://www.tcpdump.org/.
  Solution 2 :
    Verify that all packages are installed on your system.
    For example, for Debian, you have to install libpcapxx.deb
    (for the dynamic library) and libpcap-devxx.deb (for pcap.h).
  Solution 3 :
    [if the error is about pcap.h]
    The file pcap.h is not located in a good directory :
        locate "pcap.h"
    If you find it in /somewhere/pcap.h, then link it :
        ln -s /somewhere/pcap.h /usr/local/include/pcap.h
    Note : "/usr/local/include/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/include/" for example.
  Solution 4 :
    [if the error is about bpf.h]
    The file bpf.h is not located in a good directory :
         locate "bpf.h"
    If you find it in /somewhere/bpf.h, then link it :
         ln -s /somewhere/bpf.h /usr/local/include/net/bpf.h
    Note : "/usr/local/include/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/include/" for example.
  Solution 5 :
    [if the error is about bpf.h]
    The file /usr/local/include/net/bpf.h or /usr/include/net/bpf.h
    is not on your system.
    Search the cdrom of your distribution to find the file "bpf.h",
    and install the corresponding missing package.
  Solution 6 :
    [if the error is about -lpcap]
    The file libpcap.a/libpcap.so is not located in a good directory :
        locate "libpcap.a" ; locate "libpcap.so"
    If you find it in /somewhere/libpcap.a_or_so, then link it :
        ln -s /somewhere/libpcap.a /usr/local/lib/libpcap.a
        ln -s /somewhere/libpcap.so /usr/local/lib/libpcap.so
    Note : "/usr/local/lib/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/lib/" for example.

-------------------------------------------------------------------------------
Problem 8 :
  Problem synthesis :
    /usr/bin/ld: cannot find -lpcap.
  Environment affected by the problem :
    All
  What's causing the problem :
    The library libpcap doesn't seem to be installed
  Solution 1 :
    Libpcap isn't completely installed or configured
    Install it from http://www.tcpdump.org/.
  Solution 2 :
    Verify that all packages are installed on your system.
    For example, for Debian, you have to install libpcapxx.deb
    (for the dynamic library) and libpcap-devxx.deb (for pcap.h).
  Solution 3 :
    [if the error is about pcap.h]
    The file pcap.h is not located in a good directory :
        locate "pcap.h"
    If you find it in /somewhere/pcap.h, then link it :
        ln -s /somewhere/pcap.h /usr/local/include/pcap.h
    Note : "/usr/local/include/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/include/" for example.
  Solution 4 :
    [if the error is about bpf.h]
    The file bpf.h is not located in a good directory :
         locate "bpf.h"
    If you find it in /somewhere/bpf.h, then link it :
         ln -s /somewhere/bpf.h /usr/local/include/net/bpf.h
    Note : "/usr/local/include/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/include/" for example.
  Solution 5 :
    [if the error is about bpf.h]
    The file /usr/local/include/net/bpf.h or /usr/include/net/bpf.h
    is not on your system.
    Search the cdrom of your distribution to find the file "bpf.h",
    and install the corresponding missing package.
  Solution 6 :
    [if the error is about -lpcap]
    The file libpcap.a/libpcap.so is not located in a good directory :
        locate "libpcap.a" ; locate "libpcap.so"
    If you find it in /somewhere/libpcap.a_or_so, then link it :
        ln -s /somewhere/libpcap.a /usr/local/lib/libpcap.a
        ln -s /somewhere/libpcap.so /usr/local/lib/libpcap.so
    Note : "/usr/local/lib/" might not be in the path searched
           by the compiler (this is the case for the gcc optional package of
           Solaris8), so use "/usr/lib/" for example.

-------------------------------------------------------------------------------
Problem 9 :
  Problem synthesis :
    Warning : integer constant is unsigned in ANSI C, signed with -traditional.
  Environment affected by the problem :
    FreeBSD 3.1, FreeBSD 4.0, Solaris 2.8
  What's causing the problem :
    This error is in the definition of SIOCGIFCONF, which
    uses a signed number.
  Solution :
    You should edit /usr/include/sys/ioccom.h to correct IOC_IN :
        "#define IOC_IN 0x80000000u" instead of
        "#define IOC_IN 0x80000000"

-------------------------------------------------------------------------------
Problem 10 :
  Problem synthesis :
    Warning : implicit declaration of function `ether_hostton'.
  Environment affected by the problem :
    Solaris 2.x
  What's causing the problem :
    The functions "ether_hostton" and "ether_ntohost" are never
    defined.
  Solution :
    You should edit "/usr/include/netinet/if_ether.h" to add :
            int ether_hostton(char *hostname, struct ether_addr *e);
            int ether_ntohost(char *hostname, struct ether_addr *e);

-------------------------------------------------------------------------------
Problem 11 :
  Problem synthesis :
    Error : /usr/include/linux/xxx.h: No such file or directory
    Error : /usr/include/asm/xxx.h: No such file or directory
    Error : linux/xxx.h: No such file or directory
    Error : asm/xxx.h: No such file or directory
  Environment affected by the problem :
    Linux
  What's causing the problem :
    Standard includes are needed to compile.
  Solution 1 :
    Install the package libc6-dev_xxx
    For example, under Debian : libc6-dev_2.x.x-xx.deb.
  Solution 2 :
    The new kernel includes have to be reachable by the compiler.
    For example :
        ln -s /usr/src/linux-x.x.xx/include/asm /usr/include/asm
        ln -s /usr/src/linux-x.x.xx/include/linux /usr/include/linux

-------------------------------------------------------------------------------
Problem 12 :
  Problem synthesis :
    Warning : SIG_IGN : function declaration isn't a prototype
    Warning : SIG_DFL : function declaration isn't a prototype
    Warning : SIG_xxx : function declaration isn't a prototype
  Environment affected by the problem :
    Solaris
  What's causing the problem :
    Prototype for SIG_xxx is incorrect.
  Solution :
    Edit /usr/include/sys/iso/signal_iso.h (or
    /usr/include/sys/signal.h) to replace :
        #define SIG_IGN (void(*)())1
    by :
        #define SIG_IGN (void(*)(int))1

-------------------------------------------------------------------------------
Problem 13 :
  Problem synthesis :
    Warning in /usr/include/bits/string2.h
  Environment affected by the problem :
    Linux
  What's causing the problem :
    Standard inlines do not compile without warning.
  Solution :
    Edit /usr/include/string.h at line 359 (may vary, it's just
    before "#include <bits/string2.h>") to add
        #define __NO_STRING_INLINES 1

-------------------------------------------------------------------------------
Problem 14 :
  Problem synthesis :
    Segmentation fault while converting from IP address to ethernet
    address. [problem in /etc/nsswitch.conf]
  Environment affected by the problem :
    Glibc-2.?? (<2.2.1) with "nisplus" or "db" in /etc/nsswitch.conf
  What's causing the problem :
    The problem arises when calling the function ether_hostton, and when
    the entry "nisplus" or "db" is in /etc/nsswitch.conf.
    Indeed, there is an error in glibc source (glibc-2.1.3) :
      nis/nss_nisplus/nisplus-ethers.c, line 234 : 
        there is "if (name != NULL)" instead of "if (name == NULL)"
    Note : an email was sent to glibc developers. They applied a patch
           in glibc 2.2.1.
  Solution 1 :
    Edit /etc/nsswitch.conf to replace the line :
         ethers: _here_nisplus_or_nis_or_db_is_written_ files
    by :
         ethers: files
    Indeed, the problems disappears when removing "nis", "nisplus" or "db".
    You should then execute "genemake" again (and compile and install)
    to ensure that lcrzo will use ether_hostton.
  Solution 2 :
    Install glibc > 2.2.1.

-------------------------------------------------------------------------------
Problem 15 :
  Problem synthesis :
    Segmentation fault while converting from IP address to ethernet
    address. [problem in /etc/ethers]
  Environment affected by the problem :
    /etc/ethers empty
  What's causing the problem :
    The problem arises when /etc/ethers exists, but is empty.
    Indeed, there is an error in glibc source (glibc-2.1.3) :
      inet/ether_hton.c, line 76 :
        fct has only four parameters, instead of five
    Note : an email was sent to glibc developers. They applied a patch
           in glibc 2.2.1.
  Solution 1 :
    Remove the file /etc/ethers if it doesn't contain any line.
  Solution 2 :
    Install glibc > 2.2.1.

-------------------------------------------------------------------------------
Problem 16 :
  Problem synthesis :
    Lcrzo is slow.
  Environment affected by the problem :
    All
  What's causing the problem :
    I choose to create a modular library, easy to use.
    One of the consequence is the high level structuration of lcrzo.
    So, it is slower than a low level programming interface.
  Solution 1 :
    Using records (lcrzo_record.h), you can construct your packets,
    save them, and then send them.
  Solution 2 :
    You can also use only low level fonctions of lcrzo, and create
    your specific code around.
    If its still too slow, you should not use lczro and use directly
    system's functions, or buy a new computer ;)

-------------------------------------------------------------------------------
Problem 17 :
  Problem synthesis :
    Linux : Display of "linux socket: Too many open files" while calling exit().
  Environment affected by the problem :
    Linux with libpcap 0.5
  What's causing the problem :
    The function "linux_restore_ifr" of "pcap-linux.c" is called
    at the end of the program ("atexit()").
    This function uses a file descriptor, but never closes it.
    Note : An email was sent to libpcap's developers.
  Solution 1 :
    Install libpcap > 0.6 available at http://www.tcpdump.org/.
  Solution 2 :
    If you use libpcap<0.6, you have to modify the function 
    "linux_restore_ifr" of "pcap-linux.c" :
      void linux_restore_ifr(void)
      { register int fd;
        fd = socket(PF_INET, SOCK_PACKET, htons(0x0003));
        if (fd < 0)
          fprintf(stderr, "linux socket: %s", pcap_strerror(errno));
        else if (ioctl(fd, SIOCSIFFLAGS, &saved_ifr) < 0)
          fprintf(stderr, "linux SIOCSIFFLAGS: %s", pcap_strerror(errno));
        /*and here, a close was missing*/
        close(fd); /*added by Laurent, in libpcap*/
      }
      Then you have to compile and install libpcap.

-------------------------------------------------------------------------------
Problem 18 :
  Problem synthesis :
    Linux : Display of "kernel: program uses obsolete (PF_INET,SOCK_PACKET)"
    in "/var/log/messages". This is a warning only.
  Environment affected by the problem :
    Linux kernel superior to 2.1
    libpcap up to 0.5rel2
  What's causing the problem :
    The libpcap library uses a {PF_INET,SOCK_PACKET} socket.
    This kind of socket is considered as obsolete by the kernel.
    Note : an email was sent to libpcap's developers.
  Solution 1 :
    As this is a warning only message, it can be ignored.
  Solution 2 :
    Install libpcap > 0.6 available at http://www.tcpdump.org/.

-------------------------------------------------------------------------------
Problem 19 :
  Problem synthesis :
    FreeBSD : cannot sniff.
  Environment affected by the problem :
    FreeBSD
  What's causing the problem :
    bpf is not compiled in the kernel, or only a few bpfii are
    available. So we cannot sniff or spoof at Ethernet level.
  Solution :
    You have to compile your kernel with bpf support writing the following
    in /usr/src/sys/i386/KERNEL :
        "pseudo-device bpfilter 4"
    Then, you have to create the bpfii
        cd /dev
        sh MAKEDEV bpf0    (if it doesn't already exists)
        sh MAKEDEV bpf1
        sh MAKEDEV bpf2
        sh MAKEDEV bpf3
    Note : in this example, 4 bpf are created; we can use more.

-------------------------------------------------------------------------------
Problem 20 :
  Problem synthesis :
    FreeBSD : /dev/bpfii: Device not configured.
  Environment affected by the problem :
    FreeBSD
  What's causing the problem :
    bpf is not compiled in the kernel, or only a few bpfii are
    available. So we cannot sniff or spoof at Ethernet level.
  Solution :
    You have to compile your kernel with bpf support writing the following
    in /usr/src/sys/i386/KERNEL :
        "pseudo-device bpfilter 4"
    Then, you have to create the bpfii
        cd /dev
        sh MAKEDEV bpf0    (if it doesn't already exists)
        sh MAKEDEV bpf1
        sh MAKEDEV bpf2
        sh MAKEDEV bpf3
    Note : in this example, 4 bpf are created; we can use more.

-------------------------------------------------------------------------------
Problem 21 :
  Problem synthesis :
    FreeBSD : /dev/bpfii: No such file or directory.
  Environment affected by the problem :
    FreeBSD
  What's causing the problem :
    bpf is not compiled in the kernel, or only a few bpfii are
    available. So we cannot sniff or spoof at Ethernet level.
  Solution :
    You have to compile your kernel with bpf support writing the following
    in /usr/src/sys/i386/KERNEL :
        "pseudo-device bpfilter 4"
    Then, you have to create the bpfii
        cd /dev
        sh MAKEDEV bpf0    (if it doesn't already exists)
        sh MAKEDEV bpf1
        sh MAKEDEV bpf2
        sh MAKEDEV bpf3
    Note : in this example, 4 bpf are created; we can use more.

-------------------------------------------------------------------------------
Problem 22 :
  Problem synthesis :
    Linux : The computer local's address is added and the end of an IP option
    of type "record route" or "timestamp".
  Environment affected by the problem :
    Linux kernel inferior to 2.1
  What's causing the problem :
    While sniffing a packet containing IP options "record route" or
    "timestamp", which is done by libpcap, the local computer adds
    its own address at the end of the list.
    This seems to be logical, but when we sniff we want to see what
    is really on the network.
    The libpcap library uses a {PF_INET,SOCK_PACKET} socket, and this
    implementation is incorrect.
  Solution 1 :
    Kernel after 2.1 doesn't have this problem.
  Solution 2 :
    Install libpcap > 0.6 available at http://www.tcpdump.org/.

-------------------------------------------------------------------------------
Problem 23 :
  Problem synthesis :
    Linux : The sniff doesn't work.
  Environment affected by the problem :
    Linux
  What's causing the problem :
    The kernel has to be compiled with "packet socket" (CONFIG_PACKET)
    to be able to sniff.
  Solution :
    You have to compile your kernel with "packet socket" :
     - select 'Packet socket' in the menu 'Networking options'
       of 'make xconfig', or
     - edit /usr/src/linux/.config to define :
       CONFIG_PACKET=y
    The kernel then needs to be compiled and installed.

-------------------------------------------------------------------------------
Problem 24 :
  Problem synthesis :
    Linux : Display of an error in module net-pf-17 in /var/log/messages.
  Environment affected by the problem :
    Linux
  What's causing the problem :
    The kernel has to be compiled with "packet socket" (CONFIG_PACKET)
    to be able to sniff.
  Solution :
    You have to compile your kernel with "packet socket" :
     - select 'Packet socket' in the menu 'Networking options'
       of 'make xconfig', or
     - edit /usr/src/linux/.config to define :
       CONFIG_PACKET=y
    The kernel then needs to be compiled and installed.

-------------------------------------------------------------------------------
Problem 25 :
  Problem synthesis :
    While spoofing at IP level, some packets refuse to be emitted.
  Environment affected by the problem :
    Linux with IP firewalling
    Solaris
    FreeBSD
    [I guess the problem exists in almost every environment]
  What's causing the problem :
    Commonly, there are two levels of spoof :
     - ethernet level : we specify ethernet address, ip address, etc.
     - ip level : we specify ip address, etc. and the system is in charge
                  of finding the corresponding ethernet address
    The problem exists because some systems try to ensure that the
    packet is legitimate before sending it.
    If the system thinks the packet is incorrect, it will throw it, or 
    it will modify our values before sending it.
  Solution 1 :
    A generic solution consists in spoofing at ethernet level, to
    move around the system using : 
      lcrzo_spoof_set_useethforip(&spoof, LCRZO_TRUE);
  Solution 2 :
    A generic solution consists in spoofing at ethernet level, to
    move around the system using lcrzo_sendraw_eth, and all this family 
    (lcrzo_sendpacket_ethipoptdata, lcrzo_sendpacket_ethipoptudpdata,
    etc.).
  Solution 3 :
    Under Linux, you have to compile the kernel without IP firewalling
    to be allowed to emit incorrect packets.

-------------------------------------------------------------------------------
Problem 26 :
  Problem synthesis :
    While spoofing at IP level, some packets emitted doesn't have the 
    same values in the header that the ones we specified.
  Environment affected by the problem :
    Linux with IP firewalling
    Solaris
    FreeBSD
    [I guess the problem exists in almost every environment]
  What's causing the problem :
    Commonly, there are two levels of spoof :
     - ethernet level : we specify ethernet address, ip address, etc.
     - ip level : we specify ip address, etc. and the system is in charge
                  of finding the corresponding ethernet address
    The problem exists because some systems try to ensure that the
    packet is legitimate before sending it.
    If the system thinks the packet is incorrect, it will throw it, or 
    it will modify our values before sending it.
  Solution 1 :
    A generic solution consists in spoofing at ethernet level, to
    move around the system using : 
      lcrzo_spoof_set_useethforip(&spoof, LCRZO_TRUE);
  Solution 2 :
    A generic solution consists in spoofing at ethernet level, to
    move around the system using lcrzo_sendraw_eth, and all this family 
    (lcrzo_sendpacket_ethipoptdata, lcrzo_sendpacket_ethipoptudpdata,
    etc.).
  Solution 3 :
    Under Linux, you have to compile the kernel without IP firewalling
    to be allowed to emit incorrect packets.

-------------------------------------------------------------------------------
Problem 27 :
  Problem synthesis :
    Error 1001 : error in sendto()
  Environment affected by the problem :
    Linux with IP firewalling
    Solaris
    FreeBSD
    [I guess the problem exists in almost every environment]
  What's causing the problem :
    Commonly, there are two levels of spoof :
     - ethernet level : we specify ethernet address, ip address, etc.
     - ip level : we specify ip address, etc. and the system is in charge
                  of finding the corresponding ethernet address
    The problem exists because some systems try to ensure that the
    packet is legitimate before sending it.
    If the system thinks the packet is incorrect, it will throw it, or 
    it will modify our values before sending it.
  Solution 1 :
    A generic solution consists in spoofing at ethernet level, to
    move around the system using : 
      lcrzo_spoof_set_useethforip(&spoof, LCRZO_TRUE);
  Solution 2 :
    A generic solution consists in spoofing at ethernet level, to
    move around the system using lcrzo_sendraw_eth, and all this family 
    (lcrzo_sendpacket_ethipoptdata, lcrzo_sendpacket_ethipoptudpdata,
    etc.).
  Solution 3 :
    Under Linux, you have to compile the kernel without IP firewalling
    to be allowed to emit incorrect packets.

-------------------------------------------------------------------------------
Problem 28 :
  Problem synthesis :
    Linux : When we send a lot of packets at IP level (with lcrzo_sendraw_ip, 
    lcrzo_sendpacket_ipxxx, etc.), there is a saturation of the system.
  Environment affected by the problem :
    Linux
    probably other systems
  What's causing the problem :
    When using the function lcrzo_sendraw_ip, we give the packet to the
    system, and we leave it doing its jobs.
    If the ethernet destination/router address cannot be determined,
    the system keeps the packet. Theses packets, for which system thinks
    it we be able to send them later, will take memory.
    If we are trying to do a denial of service, and the packets stay in our
    system, which will saturate (for example, in 10 seconds).
    So we have to ensure the packets are really sent when we do a denial
    of service.
    On powerful computers, I also saw the system accepting more packets
    than it could really send. This is another cause of saturation.
  Solution 1 :
    (destination computer is on the LAN)
     - If the destination computer exists on the LAN, verify it is
       in the ARP cache ("arp -an"). Otherwise, try to ping it.
     - If the destination computer doesn't exists, you have to create a
       fake arp entry ("arp -s computer a:a:a:a:a:a").
  Solution 2 :
    (destination computer is after a router)
     - First, the router must be in the ARP cache ("arp -an").
       Otherwise, try to ping it.
     - Then, verify your routes ("netstat -rn") and try to ping the 
       destination.
  Solution 3 :
    (configuration OK, but powerful computer)
    The main problem is that there is no way to known if the kernel
    is saturating because of our packets. When there is the error
    (errno==ENOBUFS), it is far too late. 
    One solution is to slow down the sending process using 
    lcrzo_time_sleep. For example, we can sleep after each thousand
    packets sent. But, the sleep time depends on the system (cpu, 
    memory, network board, etc.).
    If you find a good solution to this problem, please contact me.

-------------------------------------------------------------------------------
Problem 29 :
  Problem synthesis :
    FreeBSD : cannot spoof.
  Environment affected by the problem :
    FreeBSD
  What's causing the problem :
    bpf is not compiled in the kernel, or only a few bpfii are
    available. So we cannot sniff or spoof at Ethernet level.
  Solution :
    You have to compile your kernel with bpf support writing the following
    in /usr/src/sys/i386/KERNEL :
        "pseudo-device bpfilter 4"
    Then, you have to create the bpfii
        cd /dev
        sh MAKEDEV bpf0    (if it doesn't already exists)
        sh MAKEDEV bpf1
        sh MAKEDEV bpf2
        sh MAKEDEV bpf3
    Note : in this example, 4 bpf are created; we can use more.

-------------------------------------------------------------------------------
Problem 30 :
  Problem synthesis :
    FreeBSD : /dev/bpfii: Device not configured.
  Environment affected by the problem :
    FreeBSD
  What's causing the problem :
    bpf is not compiled in the kernel, or only a few bpfii are
    available. So we cannot sniff or spoof at Ethernet level.
  Solution :
    You have to compile your kernel with bpf support writing the following
    in /usr/src/sys/i386/KERNEL :
        "pseudo-device bpfilter 4"
    Then, you have to create the bpfii
        cd /dev
        sh MAKEDEV bpf0    (if it doesn't already exists)
        sh MAKEDEV bpf1
        sh MAKEDEV bpf2
        sh MAKEDEV bpf3
    Note : in this example, 4 bpf are created; we can use more.

-------------------------------------------------------------------------------
Problem 31 :
  Problem synthesis :
    FreeBSD : /dev/bpfii: No such file or directory.
  Environment affected by the problem :
    FreeBSD
  What's causing the problem :
    bpf is not compiled in the kernel, or only a few bpfii are
    available. So we cannot sniff or spoof at Ethernet level.
  Solution :
    You have to compile your kernel with bpf support writing the following
    in /usr/src/sys/i386/KERNEL :
        "pseudo-device bpfilter 4"
    Then, you have to create the bpfii
        cd /dev
        sh MAKEDEV bpf0    (if it doesn't already exists)
        sh MAKEDEV bpf1
        sh MAKEDEV bpf2
        sh MAKEDEV bpf3
    Note : in this example, 4 bpf are created; we can use more.

-------------------------------------------------------------------------------
Problem 32 :
  Problem synthesis :
    xBSD : Packets emitted to the network always have the ethernet address of
    the board, instead of having the address specified in the packet.
  Environment affected by the problem :
    FreeBSD 3.1, 3.5, OpenBSD 2.x [FreeBSD 4.x is not concerned]
  What's causing the problem :
    The kernel doesn't allow to spoof ethernet address.
  Solution :
    The directory ../src/port/FreeBSD (or ../src/port/OpenBSD)
    contains a kernel patch/module. The patch has to be applied,
    or the module has to be activated. Read the README file present
    in such directories.


***************************************************************************
                              UNKNOWN PROBLEMS
                              ****************

If you find errors, thanks for contacting me.
For every bug report, try to indicate :
 - lcrzo/lcrzoex version
 - result of the command : lcrzoex 1
 - result of the command : lcrzoex 157
 - result of the command : lcrzoex 278
 - system (uname -a under unix)
 - command or error environment
 - how to reproduce the error
 - the patch, if you wrote one
 - other information you may think useful

My email address is on the web :
  http://www.laurentconstantin.com/     (main server)
  http://go.to/laurentconstantin/       (backup server)
  http://laurentconstantin.est-la.com/  (backup server)
