Re: Code working with LIBNET_RAW4, not with LIBNET_LINK

--Apple-Mail-9-969503075
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII; format=flowed

Well without any code, all I can say is you're doing something wrong.  
First, it doesn't look like that you used the -e or -XX/-xx flag with 
tcpdump to print the ethernet header to know where the packets are 
actually going to.  However, I can make a guess:

LIBNET_RAW4 will cause an ARP request to be made on your behalf to look 
up the destination MAC address.  The ethernet header of the built 
packet will then go to the correct address.

LIBNET_LINK does NOT do an ARP request and expects you to provide the 
dst MAC.  I'd guess that you put in the wrong dst MAC and hence it 
isn't delivered to the target host.

If you have other questions, you might want to check in the "samples" 
directory for how to build packets with the LIBNET_LINK API.

-- 
Aaron Turner <aturner at pobox.com|synfin.net>  http://synfin.net/
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -- Benjamin Franklin
All emails are PGP signed; a lack of a signature indicates a forgery.
On Jan 16, 2005, at 9:23 PM, Karen Pease wrote:

> I've just discovered libnet, and have been working on some test 
> programs to
> become familiar with it; it looks great.  I've worked my way through a 
> number
> of stumbling blocks, and have gotten most of what I have attempted to 
> do
> working; however, I cannot figure out, nor can find anything online 
> about
> this current problem.
>
> I have two versions of the same code; one builds a packet with a UDP 
> header
> and an IP header on LIBNET_RAW4 mode; the other builds a packet with a 
> UDP
> header, an IP header, and the underlying ethernet header on 
> LIBNET_LINK mode.
> tcpdump -w shows the output on the wire of the two commands as being
> identical; however, only the RAW4 version makes it to its destination.
> Here's a snippet from two tcpdump runs:
>
> Without link:
> 00004CA0   0C 3A EB 41  E3 40 0B 00  34 00 00 00  34 00 00
> 00  .:[email protected]...
> 00004CB0   00 20 E0 35  54 40 00 50  04 6C E7 30  08 00 45
> 00  . [email protected].
> 00004CC0   00 26 00 F2  00 00 40 11  A9 B7 C0 A8  00 03 81
> FF  .&....@.........
> 00004CD0   8D 73 75 30  00 50 00 08  BA 3F 01 02  03 04 05
> 06  .su0.P...?......
> 00004CE0   74 65 73 74
>
> With link:
> 00004B50   40 3A EB 41  E1 A5 0E 00  34 00 00 00  34 00 00 00
> @:.A....4...4...
> 00004B60   00 20 E0 35  54 40 00 50  04 6C E7 30  08 00 45
> 00  . [email protected].
> 00004B70   00 26 00 F2  00 00 40 11  A9 B7 C0 A8  00 03 81
> FF  .&....@.........
> 00004B80   8D 73 75 30  00 50 00 08  BA 3F 01 02  03 04 05
> 06  .su0.P...?......
> 00004B90   74 65 73 74
>
> **Unknown header**:
>
> Byte 0 is different
> Bytes 1 through 3 are the same
> Bytes 4 through 6 are different
> Bytes 7 through 15 are the same
>
> **Ethernet header**:
>
> dhost: 00 20 E0 35 54 40
> shost: 00 50 04 6C E7 30
> type:  08 00
>
> **IP header**:
>
> version: 4
> ihl:  5
> tos:  00
> tot_len: 00 26
> id:  00 F2
> frag_off: 00 00
> ttl:  40
> proto: 11
> check: A9 B7
> saddr: C0 A8 00 03
> daddr: 81 FF 8D 73
>
> **UDP header**:
>
> Proper source: 75 30
> Proper dest: 00 50
> Proper length: 00 08
> Proper check: BA 3F
>
> **Data**:
>
> Proper data: 01 02 03 04 05 06 74 65 73 74
>
> There is one header that I'm not sure what it is, and what it's for; 
> the only
> differences between the RAW and LINK versions are in these 15 bytes of 
> data.
> Also, I don't know for certain that this data is a header; it could 
> equally
> well be at the end of the packets, as the output runs end on end.
>
> Does anyone have any clue what's wrong, and what's going on here?  I'd 
> be very
> appreciative.  :)
>
>  - Karen Pease

--Apple-Mail-9-969503075
content-type: application/pgp-signature; x-mac-type=70674453;
	name=PGP.sig
content-description: This is a digitally signed message part
content-disposition: inline; filename=PGP.sig
content-transfer-encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (Darwin)

iD8DBQFB6+ODhweYF/hu2uYRAtnCAJ9vgjUCN1GtgUzSHbSBcVSW24roEQCdGtby
kYox6FV16Dq5ffWOB0FCkHI=
=zxaa
-----END PGP SIGNATURE-----

--Apple-Mail-9-969503075--