tcpdump mailing list archives
inject & read from the same interface
From: Tobias C Rittweiler <tcr () freebits de>
Date: Wed, 02 Mar 2011 11:49:13 +0100
Hi there! It seems to me that if I inject a packet P to a pcap handle H of an interface I, the next read (by pcap_next() etc.) will /not/ return P. However, if I have two handles H1 and H2 of the same interface I, and I inject P into H1, a read from H2 /will/ return that injected packet P. Is this expected behavior? I'm also interested what in pcap-linux.c makes the first behavior take place (the silent filtering of the injected packet) FWIW, the first behavior totally makes sense to me, but I need it for the second case, too, as I'm operating on multiple pcap handles to the same interface each running a different filter. Thanks in advance for any clarification on the matter, -T. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- inject & read from the same interface Tobias C Rittweiler (Mar 02)
- Re: inject & read from the same interface Guy Harris (Mar 02)