Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to use snoop on solaris 10 to detect traffic between a client and server both located on my machine. Question: I just want to verify that I should use the loopback interface for this.

So now for the real question.

I have found a few posts that suggest that you cannot use snoop on Solaris to listen to a loopback interface. Can someone verify this for me. I have found a few threads that seems to suggest this but most of them are fairly old (see links at bottom).

Has this problem been solved? Is there a way to listen to a loop back interface on Solaris 10? (Using snoop or another method. My assumption is that if snoop will not work something like wireshark will not work either).

This is what I have tried:

% sudo snoop -d lo0

Which results in this:

snoop: cannot open "lo0": DLPI link does not exist

Thanks


Links

http://forums.sun.com/thread.jspa?threadID=5252240 http://www.mail-archive.com/networking-discuss@opensolaris.org/msg01860.html http://www.derkeiler.com/Mailing-Lists/securityfocus/focus-sun/2002-08/0007.html http://opensolaris.org/jive/thread.jspa?messageID=175240

share|improve this question

5 Answers 5

up vote 3 down vote accepted

The posts are correct, you cannot snoop loopback traffic on solaris. You can't tcpdump it, you can't wireshark it. You can't dtrace it. Many have tried.

OpenSolaris supports it (via the clearview project).

share|improve this answer

https://blogs.oracle.com/seb/entry/observe_loopback_and_inter_zone

Seems like OpenSolaris has this feature (or will)

share|improve this answer

I realize that this is an old thread, but in case someone stumbles across it, it is worth noting that this appears to now be possible in Solaris 11:

http://docs.oracle.com/cd/E23824_01/html/821-1453/gexkw.html#gexnc

There is now a '-I' option that allows snoop to work with IP-layer devices.

share|improve this answer
    
It's OK to add information to old questions, especially when it solves the problem. –  Hubert Kario Feb 3 '12 at 23:01

I'm no expert in the use of Dtrace, but there may be a way to use it to capture the data.

share|improve this answer

I vaguely recall some problems with snoop on the loopback interface (something about snoop requiring a real piece of harware which is why you get that DLPI message -- there's no Data Link Provider Interface for loopback b/c it's a virtual device).

You may want to try Wireshark or plain-ol-tcpdump, but you might be out of luck Re: lo0. As an alternative you could connect one of your physical interfaces to a dead-end hub with nothing else & send your traffic over that interface.

share|improve this answer
1  
tcpdump fails with a similar error message. "tcpdump: lo0: No such device exists" "(lo0: No DLPI device found)" –  TCampbell Mar 5 '10 at 20:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.