Re: Hardware mac address with pcap/winpcap

[Guy Harris <guy () alum mit edu>]

On Mar 4, 2009, at 9:19 AM, Gianluca Varenni wrote:

> In the case of Windows/WinPcap, we have an internal Packet API to  
> get the MAC address, the main problem is exposing such MAC address  
> at the pcap API level. I actually didn't know that findalldevs was  
> returning the MAC address on (some flavors of?) linux. What is the  
> sa_family in that case?

PF_PACKET, it appears; I suspect that means the address is a  
sockaddr_ll.

It's AF_LINK on Mac OS X and, probably, *BSD; the address is some  
other sockaddr structure, different from a sockaddr_ll.

On Solaris, the MAC address isn't returned by the API libpcap uses for  
pcap_findalldevs(); you need to use DLPI interfaces to get the MAC  
address.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.