Re: RE : capturing and injection on same interface

[alex medvedev <alexm () pycckue org>]

hallo,

i thought somebody had recommended to use a filter expression to eliminate
duplicates: "not src host".
i wonder if that did not work for some reason...

-alexm
08:13 09/01/2004

On Fri, 9 Jan 2004, Jacky Buyck wrote:

> Hmmmm ... The better can be simply to use a second interface.
> What is the utility to modify and reinject a packet on the same link
> than the good one : the receiver will always received the good packet
> first ignoring your modified one. No ??? Except if you've a real need
> for this.
>
>
>
> -----Message d'origine-----
> De : owner-tcpdump-workers () sandelman ottawa on ca
> [mailto:owner-tcpdump-workers () sandelman ottawa on ca] De la part de
> Kifah A.
> Envoyé : mercredi 7 janvier 2004 15:27
> À : tcpdump-workers () tcpdump org
> Objet : [tcpdump-workers] capturing and injection on same interface
>
>
> hi everyone,
>
> i have a c-proggie using libpcap for captureing packets, and injecting
> them with altered payload only back to interface...now you can imagine i
>
> would be recapturing packets i just processed
> (altered+injectedback)...so i get into a loop!
> Is there a way to prevent that? knowing i am on OpenBSD 3.4.
> Is it using Hashtables? maybe having some values of IP header checked,
> and compared ti values saved in hashtables of packets injected? any1
> faced such a problem?
>
> Cheers
>
> -
> This is the TCPDUMP workers list. It is archived at
> http://www.tcpdump.org/lists/workers/index.html
> To unsubscribe use
> mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe
>
> -
> This is the TCPDUMP workers list. It is archived at
> http://www.tcpdump.org/lists/workers/index.html
> To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe


-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe