Re: Code working with LIBNET_RAW4, not with LIBNET_LINK
Karen Pease <[email protected]> Tue, 18 Jan 2005 02:31:06 -0600
| Newsgroups | gmane.comp.security.libnet |
|---|---|
| Message-ID | <[email protected]> |
Thank you for your help. First off, there are no samples that I could find - there were none included with the libnet on my system (installed from a FC3 rpm), nor could I find any via google. Where are they located? I relied on reading other people's code that was written with libnet, but it was often not applicable and I had to experiment around. Using the tcpdump arguments that you recommended, I was able to see that you were right - the dest hw address was in fact incorrect, and this is undoubtedly the problem. I was passing it the hw address reported on the destination machine by ifconfig for my tests using LIBNET_LINK; however, some other, unknown hw address was being sent when they were built with LIBNET_RAW4, which was making it to the destination. Is there a simple function to look up the MAC address, or will I need to build and send the ARP packets myself? I suppose it's in the samples. Again, thank you for your help; it is greatly appreciated. - Karen On Monday 17 January 2005 10:10 am, you wrote: > Well without any code, all I can say is you're doing something wrong. > First, it doesn't look like that you used the -e or -XX/-xx flag with > tcpdump to print the ethernet header to know where the packets are > actually going to. However, I can make a guess: > > LIBNET_RAW4 will cause an ARP request to be made on your behalf to look > up the destination MAC address. The ethernet header of the built > packet will then go to the correct address. > > LIBNET_LINK does NOT do an ARP request and expects you to provide the > dst MAC. I'd guess that you put in the wrong dst MAC and hence it > isn't delivered to the target host. > > If you have other questions, you might want to check in the "samples" > directory for how to build packets with the LIBNET_LINK API.