Re: mac addr of the destination in linux cooked

[Ankith Agarwal <ankitha () cdac in>]

Hi
  Thanks for the reply. One more thing, if I am particular in getting the
destination mac address, then is it better to run a pcap instance for each
of the interfaces of the system??

-> if yes, then is there a way to optimize multiple instances of
pcap??(because I have tried it, and multiple instances of pcap uses a lot
of cpu power)

Regards
Ankith

On Tue, Apr 26, 2011, Guy Harris <guy () alum mit edu> said:

> On Apr 26, 2011, at 3:45 AM, Ankith Agarwal wrote:
>
> >  I am trying to capture incoming packets in all the interfaces using
> > pcap. I just wanted to know if there is a way of finding the interface(mac
> > address or name) from which the packet has arrived??
> >
> >        (As I am using the "any" interface, I am getting the linux cooked
> > capture header in the packet and this header only contains the source mac
> > address, but I wanted to know the destination mac address
>
> Then you can't use the "any" interface, because, for a PF_PACKET/SOCK_DGRAM socket, which is what is used for the 
> "any" interface, that information is not supplied - that's why the header for DLT_LINUX_SLL packets:
>
>       http://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL.html
>
> doesn't contain the destination address.-
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.
>
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.

-- 




-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.