packet destination from pcap
keramida at ceid.upatras.gr
Mon Feb 5 02:28:10 UTC 2007
On 2007-02-04 20:16, nocturnal <nocturnal at swehack.se> wrote:
> I'm sniffing packets with pcap but i need information about where the
> packet is going.
This is a decision made by the routing table, so there's no good way to
'guess' where it will go before the packet reaches the outgoing queue of
the IP layer.
> I'm thinking i need to open two pcap sessions with two different
> filters because the application i'm writing has a need for
> distinguishing between packets going to a specified ip-address and
> those going from it.
Well, the destination IP address should be easy to grab. Even if you do
get hold of that though, you may have to listen to multiple pcap
connections to find out where the routing decisions send the packet on
its way out.
More information about the freebsd-questions