packet destination from pcap

nocturnal nocturnal at
Wed Feb 14 15:52:19 UTC 2007


After i wrote the e-mail to the list i figured out how to get the 
ethernet destination address of the packet. I'm not sure but this might 
help me because i need to figure out if the packet is moving towards me 
or away from me on the interface i've chosen. So i can compare this with 
the ethernet address of my chosen interface and figure out where it's 

Stop me if i'm wrong. :)

Med vänliga hälsningar

Stefan Midjich aka nocturnal

Giorgos Keramidas wrote:
> On 2007-02-04 20:16, nocturnal <nocturnal at> wrote:
>> Hi
>> I'm sniffing packets with pcap but i need information about where the
>> packet is going.
> This is a decision made by the routing table, so there's no good way to
> 'guess' where it will go before the packet reaches the outgoing queue of
> the IP layer.
>> I'm thinking i need to open two pcap sessions with two different
>> filters because the application i'm writing has a need for
>> distinguishing between packets going to a specified ip-address and
>> those going from it.
> Well, the destination IP address should be easy to grab.  Even if you do
> get hold of that though, you may have to listen to multiple pcap
> connections to find out where the routing decisions send the packet on
> its way out.

More information about the freebsd-questions mailing list