Re: pcap_inject() an Ethernet's FCS

[Guy Harris <guy () alum mit edu>]

On Jan 14, 2010, at 5:15 PM, David Crowcroft wrote:

> Does anyone have an example program in C-language that uses the
> pcap_inject() funtion of the libpcap library?

I've attached some programs I've written as quick tests.  They might or might not compile on your UN*X, or on Windows; 
you might have to tweak some of the #includes and/or define some of the ETHER_xxx_LEN values yourself.

> For instance, do I need to calculate the FCS in the Ethernet frames I
> send?

*Probably* not, at least in most cases.  It's not inconceivable that, if a given Ethernet device is capable of being 
told "transmit this frame, which includes the FCS field, and do not calculate the FCS yourself", the driver could, when 
handed a frame through whatever mechanism pcap_inject() uses on that platform, transmit the frame in that fashion.  I 
suspect that, in practice, that won't happen, as it complicates the job of applications that are trying to implement a 
protocol atop raw Ethernet by using that mechanism.

In particular, on at least some versions of Mac OS X:

        at least some of the Ethernet drivers will configure the hardware (if necessary) to provide the full frame 
content, including the FCS field, on received packets, and will hand those packets to BPF with the FCS, so you get the 
FCS field when you capture packets;

        when you send a packet by writing it to BPF, however, you don't have to supply the FCS;

(as indicated by my testing it with the attached programs).

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.