OpenSolaris

Heads up - Clearview IP Observability Devices

Date: Thu, 06 Nov 2008 13:39:21 +0000
From: Philip Kirk - Solaris Sustaining <Phil.Kirk at sun dot com>
To: on-all at eng dot sun dot com, onnv-gate at onnv dot eng dot sun dot com
Subject: Heads up - Clearview IP Observability Devices

The putback of:

  PSARC/2006/475  Clearview: IP Observability Devices
  4085089 add a feature to enable 'snooping' of the loopback traffic

provides an updated bfu script.  If you use an older bfu script with bfu
archives built after these changes, then you may not be able to snoop
the loopback interface with "snoop -d lo0".  To recover, bfu again with
the proper bfu script.

This feature can be used to snoop any IP interface that you see with
"ifconfig -a" at the IP layer from any zone (global or non-gobal).  This
includes the loopback interface (lo0), IP tunnels (ip.tun0).  To observe
packets at the IP layer, use snoop's new -I option (e.g., snoop -I
bge0).  New DLPI nodes in /dev/ipnet have been introduced to make this
possible.  In addition to that, a /dev/lo0 device has been introduced to
allow observability into all packets that are logically looped-back
within the ip module (packets that are both sent from and to an IP
address on the same local IP stack).  To observe all such loopback
packets, run "snoop -d lo0".  The PSARC case contains further details.

Please file bugs related to this project in the solaris/kernel/ipnet
bugster subcategory (a servicedesk request is pending to create this
subcategory; it may take a day or two to appear in bugster).

Feel free to use our project discussion mailing list for any
communication related to this project:

	clearview-discuss at opensolaris dot org

Thanks

Phil