tcpdump mailing list archives

Re: Sending a packet to localhost?


From: Guy Harris <guy () alum mit edu>
Date: Mon, 23 Feb 2009 13:55:23 -0800


On Feb 23, 2009, at 1:29 PM, Aaron Turner wrote:

tcpdump/Wireshark will show you the Linux SLL header.

...although that's not the format of the link-layer header on packets on the Linux loopback interface; those packets have fake Ethernet headers.

(The SLL header is synthesized by libpcap for link layers that either

1) have a link-layer header type for which there isn't (yet) a DLT_ value;

2) don't supply a usable link-layer header (e.g., PPP, which doesn't provide such unimportant information as the packet type);

3) don't necessarily have *a* link-layer header (e.g., the any device, which can supply packets from multiple different link-layer types).)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: