While executing tcpdump , i am getting following error.

tcpdump: BIOCSETIF: en0: Do not specify an existing file.

I checked with truss , and i able to see kioctl system is failed with "EEXIST"

==============================================

Message from truss output
--------------------------
open("/dev/bpf0", O_RDONLY) = 3
kioctl(3, -2145369492, 0x2FF22A18, 0x00000000) Err#17 EEXIST

================================================

I searched on this forum itself and i couldn't find anything.

Note : My customer wants to use tcpdump and not interested in iptrace .

There seems to be a hook or lock left in the Kernel. Use ipcrm to clear shared memory related to that former ((killed ?) tcpdump?) process. If that fails you might need a reboot.

Thanks for the quick reply .

I checked the current shared memory status and I can see only the following process which is started by root .

>ipcs -am | grep root
m 5 0xffffffff --rw-rw---- root system root system 1 4096 33028 33028 16:03:15 16:03:15 13:49:55
m 6 0xffffffff --rw-rw---- root system root system 1 4096 33028 33028 16:03:15 16:03:15 13:49:55
m 7 0xffffffff --rw-rw---- root system root system 1 4096 33028 33028 16:03:15 16:03:15 13:49:57
>ps -p 33028 -f
UID PID PPID C STIME TTY TIME CMD
root 33028 20264 0 Aug 28 - 4:16 /usr/sbin/rsct/bin/rmcd -a IBM.LPCommands -r
>

And i suspect the following semaphore

>ipcs -ps | grep root
s 1 0x62001b38 --ra-r--r-- root system
s 131077 0x01001965 --ra------- root system

As i couldn't able to see the process information , i couldn't able to take the decision to remove this semphore .

Any sugesstion to get the process id which accessed the above mentioned semaphore ?

Note : I am trying to avoid the reboot .

---------- Post updated at 09:50 PM ---------- Previous update was at 08:05 AM ----------

The issue was solved after the reboot .