Date: Wed, 14 Feb 2007 16:50:26 +0100 From: nocturnal <nocturnal@swehack.se> To: Giorgos Keramidas <keramida@ceid.upatras.gr> Cc: freebsd-questions@freebsd.org Subject: Re: packet destination from pcap Message-ID: <45D32FC2.8090107@swehack.se> In-Reply-To: <20070205022721.GA24354@kobe.laptop> References: <45C630FD.3080801@swehack.se> <20070205022721.GA24354@kobe.laptop>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi After i wrote the e-mail to the list i figured out how to get the ethernet destination address of the packet. I'm not sure but this might help me because i need to figure out if the packet is moving towards me or away from me on the interface i've chosen. So i can compare this with the ethernet address of my chosen interface and figure out where it's going. Stop me if i'm wrong. :) Med vänliga hälsningar Stefan Midjich aka nocturnal [Swehack] http://swehack.se Giorgos Keramidas wrote: > On 2007-02-04 20:16, nocturnal <nocturnal@swehack.se> wrote: >> Hi >> I'm sniffing packets with pcap but i need information about where the >> packet is going. > > This is a decision made by the routing table, so there's no good way to > 'guess' where it will go before the packet reaches the outgoing queue of > the IP layer. > >> I'm thinking i need to open two pcap sessions with two different >> filters because the application i'm writing has a need for >> distinguishing between packets going to a specified ip-address and >> those going from it. > > Well, the destination IP address should be easy to grab. Even if you do > get hold of that though, you may have to listen to multiple pcap > connections to find out where the routing decisions send the packet on > its way out. > > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45D32FC2.8090107>