Re: Code working with LIBNET_RAW4, not with LIBNET_LINK

Karen Pease <[email protected]> Tue, 18 Jan 2005 02:31:06 -0600
Newsgroups gmane.comp.security.libnet
Message-ID <[email protected]>
Thank you for your help.  First off, there are no samples that I could find - 
there were none included with the libnet on my system (installed from a FC3 
rpm), nor could I find any via google.  Where are they located?  I relied on 
reading other people's code that was written with libnet, but it was often 
not applicable and I had to experiment around.

Using the tcpdump arguments that you recommended, I was able to see that you 
were right - the dest hw address was in fact incorrect, and this is 
undoubtedly the problem.  I was passing it the hw address reported on the 
destination machine by ifconfig for my tests using LIBNET_LINK; however, some 
other, unknown hw address was being sent when they were built with 
LIBNET_RAW4, which was making it to the destination.  Is there a simple 
function to look up the MAC address, or will I need to build and send the ARP 
packets myself?  I suppose it's in the samples.

Again, thank you for your help; it is greatly appreciated.

 - Karen

On Monday 17 January 2005 10:10 am, you wrote:
> Well without any code, all I can say is you're doing something wrong.
> First, it doesn't look like that you used the -e or -XX/-xx flag with
> tcpdump to print the ethernet header to know where the packets are
> actually going to.  However, I can make a guess:
>
> LIBNET_RAW4 will cause an ARP request to be made on your behalf to look
> up the destination MAC address.  The ethernet header of the built
> packet will then go to the correct address.
>
> LIBNET_LINK does NOT do an ARP request and expects you to provide the
> dst MAC.  I'd guess that you put in the wrong dst MAC and hence it
> isn't delivered to the target host.
>
> If you have other questions, you might want to check in the "samples"
> directory for how to build packets with the LIBNET_LINK API.