packet destination from pcap

[nocturnal]

Hi

After i wrote the e-mail to the list i figured out how to get the 
ethernet destination address of the packet. I'm not sure but this might 
help me because i need to figure out if the packet is moving towards me 
or away from me on the interface i've chosen. So i can compare this with 
the ethernet address of my chosen interface and figure out where it's 
going.

Stop me if i'm wrong. :)



Med vänliga hälsningar

Stefan Midjich aka nocturnal
[Swehack] http://swehack.se


Giorgos Keramidas wrote:
> On 2007-02-04 20:16, nocturnal <nocturnal at swehack.se> wrote:
>> Hi
>> I'm sniffing packets with pcap but i need information about where the
>> packet is going.
> 
> This is a decision made by the routing table, so there's no good way to
> 'guess' where it will go before the packet reaches the outgoing queue of
> the IP layer.
> 
>> I'm thinking i need to open two pcap sessions with two different
>> filters because the application i'm writing has a need for
>> distinguishing between packets going to a specified ip-address and
>> those going from it.
> 
> Well, the destination IP address should be easy to grab.  Even if you do
> get hold of that though, you may have to listen to multiple pcap
> connections to find out where the routing decisions send the packet on
> its way out.
> 
> 
>