Code working with LIBNET_RAW4, not with LIBNET_LINK

Karen Pease <[email protected]> Sun, 16 Jan 2005 23:23:11 -0600
Newsgroups gmane.comp.security.libnet
Message-ID <[email protected]>
I've just discovered libnet, and have been working on some test programs to 
become familiar with it; it looks great.  I've worked my way through a number 
of stumbling blocks, and have gotten most of what I have attempted to do 
working; however, I cannot figure out, nor can find anything online about 
this current problem.

I have two versions of the same code; one builds a packet with a UDP header 
and an IP header on LIBNET_RAW4 mode; the other builds a packet with a UDP 
header, an IP header, and the underlying ethernet header on LIBNET_LINK mode.  
tcpdump -w shows the output on the wire of the two commands as being 
identical; however, only the RAW4 version makes it to its destination.  
Here's a snippet from two tcpdump runs:

Without link:
00004CA0   0C 3A EB 41  E3 40 0B 00  34 00 00 00  34 00 00 
00  .:[email protected]...
00004CB0   00 20 E0 35  54 40 00 50  04 6C E7 30  08 00 45 
00  . [email protected].
00004CC0   00 26 00 F2  00 00 40 11  A9 B7 C0 A8  00 03 81 
FF  .&....@.........
00004CD0   8D 73 75 30  00 50 00 08  BA 3F 01 02  03 04 05 
06  .su0.P...?......
00004CE0   74 65 73 74

With link:
00004B50   40 3A EB 41  E1 A5 0E 00  34 00 00 00  34 00 00 00  
@:.A....4...4...
00004B60   00 20 E0 35  54 40 00 50  04 6C E7 30  08 00 45 
00  . [email protected].
00004B70   00 26 00 F2  00 00 40 11  A9 B7 C0 A8  00 03 81 
FF  .&....@.........
00004B80   8D 73 75 30  00 50 00 08  BA 3F 01 02  03 04 05 
06  .su0.P...?......
00004B90   74 65 73 74

**Unknown header**:

Byte 0 is different
Bytes 1 through 3 are the same
Bytes 4 through 6 are different
Bytes 7 through 15 are the same

**Ethernet header**:

dhost: 00 20 E0 35 54 40
shost: 00 50 04 6C E7 30
type:  08 00

**IP header**:

version: 4
ihl:  5
tos:  00
tot_len: 00 26
id:  00 F2
frag_off: 00 00
ttl:  40
proto: 11
check: A9 B7
saddr: C0 A8 00 03
daddr: 81 FF 8D 73

**UDP header**:

Proper source: 75 30
Proper dest: 00 50
Proper length: 00 08
Proper check: BA 3F

**Data**:

Proper data: 01 02 03 04 05 06 74 65 73 74

There is one header that I'm not sure what it is, and what it's for; the only 
differences between the RAW and LINK versions are in these 15 bytes of data.  
Also, I don't know for certain that this data is a header; it could equally 
well be at the end of the packets, as the output runs end on end.

Does anyone have any clue what's wrong, and what's going on here?  I'd be very 
appreciative.  :)

 - Karen Pease