packet destination from pcap
nocturnal at swehack.se
Wed Feb 14 15:52:19 UTC 2007
After i wrote the e-mail to the list i figured out how to get the
ethernet destination address of the packet. I'm not sure but this might
help me because i need to figure out if the packet is moving towards me
or away from me on the interface i've chosen. So i can compare this with
the ethernet address of my chosen interface and figure out where it's
Stop me if i'm wrong. :)
Med vänliga hälsningar
Stefan Midjich aka nocturnal
Giorgos Keramidas wrote:
> On 2007-02-04 20:16, nocturnal <nocturnal at swehack.se> wrote:
>> I'm sniffing packets with pcap but i need information about where the
>> packet is going.
> This is a decision made by the routing table, so there's no good way to
> 'guess' where it will go before the packet reaches the outgoing queue of
> the IP layer.
>> I'm thinking i need to open two pcap sessions with two different
>> filters because the application i'm writing has a need for
>> distinguishing between packets going to a specified ip-address and
>> those going from it.
> Well, the destination IP address should be easy to grab. Even if you do
> get hold of that though, you may have to listen to multiple pcap
> connections to find out where the routing decisions send the packet on
> its way out.
More information about the freebsd-questions