pcap_inject vs. pcap_sendpacket and max frame size

["Aaron Turner" <synfinatic () gmail com>]

Odd problem under OS X:

I've tried using both pcap_inject() and pcap_sendpacket() to send raw
ethernet frames and I've found that pcap_sendpacket() has no problem
sending a 1514byte frame (14 byte ethernet header w/ 1500 bytes of
data) while pcap_inject() complains that the frame is too large (errno
= 40, "send: Message too long")

Key details:
MacBook Pro running OS X 10.4.9
libpcap 0.9.5
MTU 1500
Packet #10 from
http://tcpreplay.synfin.net/trac/browser/trunk/test/test.rewrite_pad

Utilizing the raw BPF device to send the same packet seems to work for
me as well.

On a whim, I tried disabling BIOCSHDRCMPLT in libpcap/pcap-bpf.c, but
that didn't seem to have any impact.

anyways, here is the offending code:
#elif defined HAVE_PCAP_INJECT
   retcode = pcap_inject(sp->handle.pcap, (void*)data, len);
   if (retcode < 0 && errno == ENOBUFS && !didsig) {
       sp->retry ++;
       goto TRY_SEND_AGAIN;
   } else if (retcode < 0) {
       sendpacket_seterr(sp, "Error with pcap_inject(packet "
COUNTER_SPEC "): %s",
           sp->sent + 1, pcap_geterr(sp->handle.pcap));
   }

#elif defined HAVE_PCAP_SENDPACKET
   retcode = pcap_sendpacket(sp->handle.pcap, data, (int)len);
   if (retcode < 0 && errno == ENOBUFS && !didsig) {
       sp->retry ++;
       goto TRY_SEND_AGAIN;
   } else if (retcode < 0) {
       sendpacket_seterr(sp, "Error with pcap_sendpacket(packet "
COUNTER_SPEC "): %s",
           sp->sent + 1, pcap_geterr(sp->handle.pcap));
   }

   /*
    * pcap_sendpacket returns 0 on success, not the packet length!
    * hence, as a special case, update the counters here and return len
    */
   sp->bytes_sent += len;
   sp->sent ++;
   return len;

--
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing & replay tools for Unix
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.