Ubuntu AMD64 client not capturing network traffic

[nimd4]

Running on XFCE Quantal (Xubuntu 12.10)

Code:

~$ lsb_release -a
No LSB modules are available.
Distributor ID:    Ubuntu
Description:    Ubuntu 12.10
Release:    12.10
Codename:    quantal

According to the KB Linux installation I need / and have:

• libQtCore:
  • libqtcore4
• libQtWebKit:
  • libqtwebkit4
• libqt4-sql:
  • libqt4-sql
• libqt4-sql-sqlite:
  • libqt4-sql-sqlite
• openssl-devel:
  • libssl-dev

There is no openssl-devel && libssl-dev says:

Quote:libssl and libcrypto development libraries, header files and manpages.

It is part of the OpenSSL implementation of SSL.

• libpcap:
  • libpcap0.8

Also added libpcap-dev and whether it's needed or not, after executing setcap (whatpulse running from the home dir, symlinked from /usr/local/bin)

Code:

~$ sudo getcap ~/bin/whatpulse
/home/kgbme/bin/whatpulse = cap_net_admin,cap_net_raw+eip

it seems to load fine and there are no network statistics.

Code:

~$ whatpulse
Database check:  "ok"
"/home/kgbme/.local/share/data/WhatPulse/whatpulse.db"
Starting AsyncDatabase
Starting AsyncDatabase
Creating device listener for "/dev/input/event0"
Creating device listener for "/dev/input/event1"
Creating device listener for "/dev/input/event10"
Creating device listener for "/dev/input/event11"
Creating device listener for "/dev/input/event12"
Creating device listener for "/dev/input/event13"
Creating device listener for "/dev/input/event14"
Creating device listener for "/dev/input/event15"
Creating device listener for "/dev/input/event16"
Creating device listener for "/dev/input/event2"
Creating device listener for "/dev/input/event3"
Creating device listener for "/dev/input/event4"
Creating device listener for "/dev/input/event5"
Creating device listener for "/dev/input/event6"
Creating device listener for "/dev/input/event7"
Creating device listener for "/dev/input/event8"
Creating device listener for "/dev/input/event9"
Starting NetworkMonitor..
WhatPulse has started

I have tried running as root, moot and even a little derp just now hehe. ;p

Give me a hand with this, pls. I'm on a completely fresh install, wiped everything to make sure it's not my doing and still getting nowhere.

[smitmartijn]

Everything seems to be in order, but it simply does not see any network interfaces. What kind of interfaces do you have (brand/type/device)?

One way to see whether it's WhatPulse or your system is to try running wireshark. WhatPulse basically uses the same drivers as that.

[nimd4]

Installed and ran wireshark on the before system and it was fine. LAN adapter is on the motherboard, removed the second card before reinstalling (info not sudo just to avoid listing the serial number)

Code:

~$ lspci -vvnn

02:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller [10ec:8168] (rev 06)
    Subsystem: Micro-Star International Co., Ltd. Device [1462:7750]
    Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
    Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
    Latency: 0, Cache Line Size: 64 bytes
    Interrupt: pin A routed to IRQ 48
    Region 0: I/O ports at d000 [size=256]
    Region 2: Memory at dc104000 (64-bit, prefetchable) [size=4K]
    Region 4: Memory at dc100000 (64-bit, prefetchable) [size=16K]
    Capabilities: <access denied>
    Kernel driver in use: r8169
    Kernel modules: r8169

Guess I will have to have it like that for now, hopefully something turns up.

Edit: Just saw this post and to list (again) that I have: libpcap-dev, libpcap0.8 and libpcap0.8-dev all present.

[drdamour]

i'm getting the same behaviour, no interfaces listed

[FamilienVater]

On one of my machines, I've removed linuxmint14 and reinstalled with standard ubuntu 12.10.

Since upgrading from linuxmint13 to 14 introduced the "no interfaces" problem on two machines during the beta and ubuntu worked on a third machine just fine, I hoped somehow it would fix the problem, but it didn't.

Here is my network card (it's an add-on-card, the mainboard only has 100MBit and the mainboard's card is disabled in bios)

(On the same machine, the network can be captured under Windows Vista 32 and Windows XP 64)

Code:

02:01.0 Ethernet controller [0200]: Intel Corporation 82541PI Gigabit Ethernet Controller [8086:107c] (rev 05)
    Subsystem: Intel Corporation PRO/1000 GT Desktop Adapter [8086:1376]
    Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
    Status: Cap+ 66MHz+ UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
    Latency: 252 (63750ns min), Cache Line Size: 64 bytes
    Interrupt: pin A routed to IRQ 16
    Region 0: Memory at dffc0000 (32-bit, non-prefetchable) [size=128K]
    Region 1: Memory at dffa0000 (32-bit, non-prefetchable) [size=128K]
    Region 2: I/O ports at de00 [size=64]
    [virtual] Expansion ROM at fde00000 [disabled] [size=128K]
    Capabilities: [dc] Power Management version 2
        Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
        Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=1 PME-
    Capabilities: [e4] PCI-X non-bridge device
        Command: DPERE- ERO+ RBC=512 OST=1
        Status: Dev=00:00.0 64bit- 133MHz- SCD- USC- DC=simple DMMRBC=2048 DMOST=1 DMCRS=8 RSCEM- 266MHz- 533MHz-
    Kernel driver in use: e1000
    Kernel modules: e1000

[Sathallrin]

Same issue, no interfaces in whatpulse.

Code:

02:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller [10ec:8168] (rev 02)
    Subsystem: Hewlett-Packard Company Device [103c:2a6f]
    Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
    Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
    Latency: 0, Cache Line Size: 32 bytes
    Interrupt: pin A routed to IRQ 44
    Region 0: I/O ports at e800 [size=256]
    Region 2: Memory at febff000 (64-bit, non-prefetchable) [size=4K]
    Region 4: Memory at f8ff0000 (64-bit, prefetchable) [size=64K]
    Expansion ROM at febc0000 [disabled] [size=128K]
    Capabilities: <access denied>
    Kernel driver in use: r8169

Code:

$ getcap /usr/bin/whatpulse
/usr/bin/whatpulse = cap_net_admin,cap_net_raw+eip

Code:

$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.10.131  netmask 255.255.255.0  broadcast 10.10.10.255
        inet6 fe80::21f:c6ff:fe30:41a9  prefixlen 64  scopeid 0x20<link>
        ether 00:1f:c6:30:41:a9  txqueuelen 1000  (Ethernet)
        RX packets 108816  bytes 81351944 (77.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 86580  bytes 50164338 (47.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 16436
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 320  bytes 21797 (21.2 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 320  bytes 21797 (21.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[nimd4]

(12-28-2012 09:56 PM)Sathallrin Wrote:  Same issue, no interfaces in whatpulse.

Just to make sure it is the same issue, you get no error messages when running whatpulse from terminal?..

I was kinda hoping that 2.0.1 will *fix* the issue, but no joy. Still not interfaces, Wireshark works fine.

[Sathallrin]

(01-02-2013 09:46 PM)nimd4 Wrote:  Just to make sure it is the same issue, you get no error messages when running whatpulse from terminal?..

I was kinda hoping that 2.0.1 will *fix* the issue, but no joy. Still not interfaces, Wireshark works fine.

Yeah, I don't get any errors about the network.

Code:

$ whatpulse
Database check:  "ok"
"/home/sathallrin/.local/share/data/WhatPulse/whatpulse.db"
Starting AsyncDatabase
Starting AsyncDatabase
Creating device listener for "/dev/input/event0"
Creating device listener for "/dev/input/event1"
Creating device listener for "/dev/input/event10"
Creating device listener for "/dev/input/event2"
Creating device listener for "/dev/input/event3"
Creating device listener for "/dev/input/event4"
Creating device listener for "/dev/input/event5"
Creating device listener for "/dev/input/event6"
Creating device listener for "/dev/input/event7"
Creating device listener for "/dev/input/event8"
Creating device listener for "/dev/input/event9"
Starting NetworkMonitor..
WhatPulse has started
QLayout: Attempting to add QLayout "" to QWidget "", which already has a layout
QPropertyAnimation: you're trying to animate a non-existing property opacity of your QObject

I was able to get it to work on my laptop. The only difference between the laptop and the desktop is the laptop uses NetworkManager to connect to the wireless while the desktop has a hardcoded static IP for eth0.

The difference I saw was the laptop wrote a line about monitoring wlan0 after the "Starting NetworkMonitor.." line. (I'm not sure on the exact wording at the moment as I don't have the laptop available at the time of posting this)

** Edit **
The message the one machine working correctly is this:

Code:

Starting NetworkMonitor..
NetworkMonitor: Starting interface  3
pcap thread started on interface  "wlan0"
WhatPulse has started

[dutchmega]

I can confirm the problem, we are working on it for 2.02

[FamilienVater]

Just some notes:

I can rule out the static IPs, all my computers (aside from the server and the NAS which both do not run WhatPulse) use DHCP and the standard network manager of ubuntu 12.10 and/or linuxmint14.

On one of the notebooks the wlan interface is recognized and counts towards network traffic, but the ethernet interface on the same machine does not work. Doesn't matter if only one of them is connected or both.

On my desktop-pc which has not wlan but is a triple-boot-system, the network-card is recognized under both vista32 and xp64 - but not under linuxmint14 or ubuntu12.10 (both 64bit).

And yes, all the same: no error message from whatpulse and wireshark is able to see and capture the devices.

Please contact me, if I can be of any further assistance. I'd be happy to help.