Re: [tcpdump-workers] libpcap pcap_sendpacket support across platforms.

On Tue, 23 Mar 2004 14:14:48 -0800, Mike Schiffman <[email protected]> 
wrote:

> Hi there. Guy Harris CC'd me on the libnet tip so I thought I'd throw my 
> hat into the ring and ask a question: how serious was the discussion 
> around unifying the two libraries? We've talked about it on the libnet 
> list recently (libnet list included on the CC line) and I'm curious what 
> your thoughts are...
>
> On Mar 23, 2004, at 1:14 PM, Guy Harris wrote:
>
>>
>> On Mar 23, 2004, at 12:09 PM, Michael Richardson wrote:
>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>
>>>
>>>>>>>> "Guy" == Guy Harris <[email protected]> writes:
>>>     Guy> I've merged your changes with a version I'd been working on,
>>>     Guy> based on libnet and some stuff we had at Network Appliance, 
>>> and
>>>     Guy> checked the result in.  It implements *two* APIs -
>>>     Guy> "pcap_inject()", from OpenBSD, and "pcap_sendpacket()", from
>>>     Guy> WinPcap.
>>>
>>>   okay. Can we call the next release libpcap 1.0 then?
>>
>> Sounds good to me, although there are other API changes I'd want to 
>> make as well for a 1.0 release.
>>
>>>   Anyone want to make any non-backwards compatible changes to the file
>>> format?
>>
>> I think 1.0 should support the libpcap-next-generation format; I have 
>> some things to add, as have others.
>>
>> Both of these mean that 1.0 probably shouldn't come out in the 
>> immediate future, but we just did 0.8 so that's probably not a problem.
>>
>>
>>
>> <!DSPAM:4060a8a246016223118835>
>>
>>
>>
> --
> Mike Schiffman, CISSP
> http://www.packetfactory.net/schiffman
> Doveryay No Proveryay
>

hello

i was cc'd in via the libnet mailing list

I really think there needs to be sort sort of unification between the two 
libraries libpcap and libnet.... but joining them i don;t know if that the 
best idea.... both require a fair amount of work to maintian so why not 
start another api to handle the unification

The aim of the new api would be to act as the glue between both written 
and captured frames, basically a userland stack api (ideally conforming to 
all the relevant RFC's). Frames from libpcap could use this api to 
determine what part of the libnet api to use to send frames required to 
create a connection for example. The programmer could have full contol 
over a stream and not have to worry about each individual frame (unless 
they want to)... this would save manually handling connection states, 
retransmission problems, fragementation issues and dropped packets 
currently faced while using both lipcap and libnet. Frédéric Raynal 
implemented something similar for handling connections a while back but i 
can;t find it on his site.... looked pretty good from what i can remember 
:)

I do think that libpcap should be able to send packets... if someone is 
using libpcap to capture connections which should be terminated with a 
simple rst, for example,  there should be a way to send a frame as another 
api shouldn;t be required for anything this trivial.... anything more 
complicated use libnet :)

On the flip side disregarding everything i just said..... would one API 
for userland networking be that bad idea? many programs require libnet, 
libpcap and libdnet why not chuck them all together? would make quite a 
bit of sense in the long run would it not? A greater userbase with more 
eyes looking at the code can;t be bad.

A quick list of advantages and disadvanteage for joining the API's

Advanatages
More people looking at the source code
Easier install one api opposed to two or three api's
Greater portability - libpcap seem to run on everything ;) congratz on the 
recent libnet win32 port btw ;)
Easier API for a developer....interfaces would only need to be selected 
once for example.
TCPReplay capabilites within the api?


Disadvantages
The api would be more complex and harder to maintain?
Couldn;t really think of any others ;)


my initial thoughts as u can probably tell were against the idea.... but 
if the main developers are up for it can;t see why not ;)

enough ranting for this evening ;)

Cheers
Ste Jones
NetworkPenetration.com