inject & read from the same interface

[Tobias C Rittweiler <tcr () freebits de>]

Hi there!

It seems to me that if I inject a packet P to a pcap handle H
of an interface I, the next read (by pcap_next() etc.) will
/not/ return P.

However, if I have two handles H1 and H2 of the same interface I,
and I inject P into H1, a read from H2 /will/ return that injected
packet P.

Is this expected behavior?

I'm also interested what in pcap-linux.c makes the first behavior
take place (the silent filtering of the injected packet)

FWIW, the first behavior totally makes sense to me,
but I need it for the second case, too, as I'm operating
on multiple pcap handles to the same interface each running
a different filter.

Thanks in advance for any clarification on the matter,

  -T.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.