2 Mar 2011 01:14
2 Mar 2011 10:00
2 Mar 2011 16:49
2 Mar 2011 11:49
inject & read from the same interface
Tobias C Rittweiler <tcr <at> freebits.de>
2011-03-02 10:49:13 GMT
2011-03-02 10:49:13 GMT
Hi there! It seems to me that if I inject a packet P to a pcap handle H of an interface I, the next read (by pcap_next() etc.) will /not/ return P. However, if I have two handles H1 and H2 of the same interface I, and I inject P into H1, a read from H2 /will/ return that injected packet P. Is this expected behavior? I'm also interested what in pcap-linux.c makes the first behavior take place (the silent filtering of the injected packet) FWIW, the first behavior totally makes sense to me, but I need it for the second case, too, as I'm operating on multiple pcap handles to the same interface each running a different filter. Thanks in advance for any clarification on the matter, -T.
2 Mar 2011 20:12
Re: inject & read from the same interface
Guy Harris <guy <at> alum.mit.edu>
2011-03-02 19:12:07 GMT
2011-03-02 19:12:07 GMT
On Mar 2, 2011, at 2:49 AM, Tobias C Rittweiler wrote: > Is this expected behavior? The only thing I'd expect in this case is whatever the particular mechanism atop which libpcap runs on a particular OS does; that may well differ from OS to OS. > I'm also interested what in pcap-linux.c makes the first behavior > take place (the silent filtering of the injected packet) Probably its use of PF_PACKET sockets to capture and send traffic. Now, whether there's another mechanism that provides the behavior you want (and is equally usable for the purposes of libpcap), or whether there's a way to configure a PF_PACKET socket so that it provides as input on that socket packets sent on that socket, is another matter.
2 Mar 2011 20:33
Re: Request for new DLT value for Wireshark Dissector
Guy Harris <guy <at> alum.mit.edu>
2011-03-02 19:33:48 GMT
2011-03-02 19:33:48 GMT
On Mar 2, 2011, at 7:49 AM, Schemmel, Hans-Christoph wrote: > I just want to ask if you´ve already assigned a DLT value for the dissector? Not yet - I've been somewhat busy the past week and a half, and I have to condense all the e-mail on this thread into a complete and precise description of the data format, to put into the pcap/bpf.h and pcap-common.c files. If somebody else were to do so, that would probably speed the process up significantly....- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
3 Mar 2011 18:01
Re: Request for new DLT value for Wireshark
Schemmel, Hans-Christoph <hans-christoph.schemmel <at> cinterion.com>
2011-03-03 17:01:31 GMT
2011-03-03 17:01:31 GMT
Guy Harris <guy <at> alum.mit.edu> writes:
>
> Not yet - I've been somewhat busy the past week and a half, and I have to
condense all the e-mail on this thread
> into a complete and precise description of the data format, to put into the
pcap/bpf.h and pcap-common.c
> files. If somebody else were to do so, that would probably speed the process
up significantly....-
>
Hello Guy,
this is the detailed description of the data format.
LINKTYPE_MUX27010
Packet structure:
1 2 3 4
Header_Size | Msg_ID | Freg_ID | Start_Pos | ...
(1 Octet) |(2 Octets) | (2 Octets) | (1 Octet) | ...
5 6 7
... End_pos | Flag | Direction | ...
... (1 Octet) | (1 Octet)| (1 Octet) | ...
8 9 10 11
... Flag_Mux | Address | Control | Length | ...
(Continue reading)
3 Mar 2011 20:48
ipv6 DAD packets?
Jeff Sadowski <jeff.sadowski <at> gmail.com>
2011-03-03 19:48:19 GMT
2011-03-03 19:48:19 GMT
I'm trying to set something up like a ipv6 version of arp for now. Final goal of my current project is to create a means of Dynamic DNS with radvd (router advertisement deamon) All I'm looking for with using tcpdump is an ipv6 address to mac address mapping. Thus I could verify every so often that the mac still has that ipv6 address with other methods. It looks like the Duplicate Address Detection Packet may be an ICMPv6 but I couldn't figure out how to filter icmpv6 I tried "tcpdump ip6 and icmp" but it says im blocking all. How would I do what I am trying to do? I can't quite figure out tcpdump syntax.
3 Mar 2011 21:31
Re: ipv6 DAD packets?
Eloy Paris <peloy <at> chapus.net>
2011-03-03 20:31:33 GMT
2011-03-03 20:31:33 GMT
On 03/03/2011 02:48 PM, Jeff Sadowski wrote: [...] > I tried "tcpdump ip6 and icmp" but it says im blocking all. How would > I do what I am trying to do? > I can't quite figure out tcpdump syntax. "tcpdump icmp6", per pcap-filter(7), does not do what you need? Cheers, Eloy Paris.-
3 Mar 2011 21:52
Re: ipv6 DAD packets?
Jeff Sadowski <jeff.sadowski <at> gmail.com>
2011-03-03 20:52:15 GMT
2011-03-03 20:52:15 GMT
On Thu, Mar 3, 2011 at 1:31 PM, Eloy Paris <peloy <at> chapus.net> wrote: > On 03/03/2011 02:48 PM, Jeff Sadowski wrote: > > [...] > >> I tried "tcpdump ip6 and icmp" but it says im blocking all. How would >> I do what I am trying to do? >> I can't quite figure out tcpdump syntax. > > "tcpdump icmp6", per pcap-filter(7), does not do what you need? > with -vv it shows the mac but Is there a way to put the full packet all on one line that I can parse the output easier > Cheers, > > Eloy Paris.- > - > This is the tcpdump-workers list. > Visit https://cod.sandelman.ca/ to unsubscribe. >
RSS Feed