Re: pcap_inject()

[Guy Harris <guy () alum mit edu>]

On Feb 9, 2010, at 10:20 PM, Frank W. Miller wrote:

> I'm getting the feeling that pcap_inject() isn't well supported?

I guess it's a question of which code we're talking about in the code path to the hardware.

pcap_inject() - like the rest of libpcap - is implemented atop an underlying mechanism in the OS (or, in 
Windows/WinPcap, atop a kernel-level driver that runs atop an underlying mechanism in the OS; in UN*Xes, the kernel 
mechanism is built in).  To a large degree, pcap_inject() (and the rest of libpcap) depends on the kernel-mode code it 
uses; the libpcap developers don't own that code and can, at best, compensate for problems in that code, and sometimes 
can't even do that.

It could be that libpcap is doing something wrong, although what it does is relatively simple - it does a send() system 
call on the socket descriptor it opened.  It *might* be that, if the socket is in memory-mapped mode, that doesn't 
work, but I'd have to look at the Linux kernel socket code to see.  It might also be that a send() on the socket is 
what it should be doing, but, somehow, that's not working, either due to a Linux kernel bug or a driver bug.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.