Date: Wed, 31 Mar 1999 12:02:08 -0800 From: "Justin C. Walker" <justin@apple.com> To: Christopher Sedore <cmsedore@mailbox.syr.edu> Cc: Tom Brown <tomb@heliox.com>, Graham Wheeler <gram@cdsec.com>, hackers@FreeBSD.ORG Subject: Re: How do I write to the /dev/bpf0 interface? Message-ID: <199903312002.MAA00975@rhapture.apple.com> In-Reply-To: <370268D7.68012311@heliox.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> From: Christopher Sedore <cmsedore@mailbox.syr.edu>
> Date: 1999-03-31 11:28:17 -0800
>
> On Wed, 31 Mar 1999, Tom Brown wrote:
>
> > So my supposition that I could write to it like any other file handle
> > was correct ?
> >
> >
> > So I can just write the following to the interface for example:
> >
> >
> > ddddddddddddXXXXXXXXXXXXiiiiiiiiiiiiiiiiiiiiiiiiiii.....
> > d=destination address
> > X=don't care
> > i=information
> >
> > Bash# ethergenerator.pl>/dev/bpf0
> >
> > Is that correct?
>
> Yes, though worth note is that most ethernet packets we care about
(IP for
> instance) have the following wire format
>
> [dest, 6 bytes][src, 6 bytes][type, 2 bytes][data, up to 1500 bytes]
To be even more "politically correct on the wire", the
"[type, 2 bytes]" chunk of the packet is actually "type or length",
with the packet being interpreted as 802.2 if that two bytes has an
integer value smaller than the MTU of ethernet (1514 bytes).
AppleTalk, IPX, and a few others use this framing instead of the
"type" framing. Oh, and remember that all good networks are "big
endian" :-}.
Regards,
Justin
> Depending on who you're talking to, you might want to make sure
that the
> two type bytes are not used by another protocol (0800 for IP, 0806 for
> ARP, 8137 for IPX, etc) so you don't bother any existing protocol
stacks.
>
> >
> > What happens if I want to put in a source MAC address?
>
> It is silently overwritten, at least in 3.1. I haven't checked what
> happens in 2.x.x.
>
> > You also mentioned that it might be a bug with 2.2.8, which
> > combination's of card / operating systems might work?
>
> If you look on the FreeBSD Gnats page, you'll see (toward the very
bottom
> of the page in the non-critical catagory) a bug report from me on this
> problem. Included in that bug report is a patch which fixed the
problem
> for me (and should fix it in general). After applying that patch, you
> must put the source address in the packet (the way it should be IMHO).
>
> -Chris
>
> >
> > Christopher Sedore wrote:
> > >
> > > On Wed, 31 Mar 1999, Graham Wheeler wrote:
> > >
> > > > Christopher Sedore wrote:
> > > > >
> > > > > On Wed, 31 Mar 1999, Graham Wheeler wrote:
> > > > >
> > > > > > Tom Brown wrote:
> > > > > >
> > > > > > > Can anyone please tell me how to post a packet onto my
LAN via this
> > > > > > > interface.
> > > > > >
> > > > > > You should just be able to write the frame. Make sure
everything is in
> > > > > > network-byte order. You needn't put in a source Ethernet
address as that
> > > > > > will get filled in, but you do need to put in a destination.
> > > > >
> > > > > Note that this is probably a bug in the bpf
implementation. BPF/the
> > > > > kernel shouldn't be messing with the packet on a write to a bpf
> > > > > descriptor. I've filed a bug report (with patch) that
addresses this.
> > > > >
> > > >
> > > > It probably isn't the bpf code that is doing this, but the
NIC driver
> > > > code...
> > >
> > > Actually, its a cooperative effort by bpfwrite() and
ether_output().
> > >
> > > -Chris
> >
> >
> > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > with "unsubscribe freebsd-hackers" in the body of the message
> >
>
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-hackers" in the body of the message
>
>
Justin C. Walker, Curmudgeon-At-Large *
Institute for General Semantics |
Manager, CoreOS Networking | Men are from Earth.
Apple Computer, Inc. | Women are from Earth.
2 Infinite Loop | Deal with it.
Cupertino, CA 95014 |
*-------------------------------------*-------------------------------*
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199903312002.MAA00975>