tcpdump mailing list archives
Re: inject & read from the same interface
From: Guy Harris <guy () alum mit edu>
Date: Wed, 2 Mar 2011 11:12:07 -0800
On Mar 2, 2011, at 2:49 AM, Tobias C Rittweiler wrote:
Is this expected behavior?
The only thing I'd expect in this case is whatever the particular mechanism atop which libpcap runs on a particular OS does; that may well differ from OS to OS.
I'm also interested what in pcap-linux.c makes the first behavior take place (the silent filtering of the injected packet)
Probably its use of PF_PACKET sockets to capture and send traffic. Now, whether there's another mechanism that provides the behavior you want (and is equally usable for the purposes of libpcap), or whether there's a way to configure a PF_PACKET socket so that it provides as input on that socket packets sent on that socket, is another matter. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- inject & read from the same interface Tobias C Rittweiler (Mar 02)
- Re: inject & read from the same interface Guy Harris (Mar 02)