Re: pcap_inject troubleshooting

[Guy Harris <guy () alum mit edu>]

On Jan 12, 2009, at 9:05 PM, David Murray wrote:

> Good point. However, the packets that I am capturing are going
> end-to-end and they are being replayed to the same receiver.
> Subsequently, the payload size of the frame should be less than 1500.

What *is* the payload size of a frame that's not being successfully  
sent?

> Do you think it is possible that when I capture and replay these
> packets pcap is appending new headers to the frame without removing  
> the
> old hence pushing the packet size above 1514 bytes for Ethernet?


Libpcap wouldn't do that - the code in libpcap to transmit packets is  
Pretty Damn Simple; for example, in Linux, it's a bunch of error  
checking to make sure you're not sending on the "any" device, followed  
by

        ret = send(handle->fd, buf, size, 0);
        if (ret == -1) {
                snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
                    pcap_strerror(errno));
                return (-1);
        }
        return (ret);

so it just takes your data and hands it to the send() system call on  
the PF_PACKET socket it opened for capturing and sending.

Whether the Linux *kernel* adds additional headers is another matter,  
but I don't expect it to.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.