Re: Code working with LIBNET_RAW4, not with LIBNET_LINK

Read through the sample code that comes with libnet 
(www.packetfactory.net/libnet). This sounds like a simple problem that 
could be solved by seeing the relevant code.

On Jan 18, 2005, at 12:31 AM, Karen Pease wrote:

> Thank you for your help.  First off, there are no samples that I could 
> find -
> there were none included with the libnet on my system (installed from 
> a FC3
> rpm), nor could I find any via google.  Where are they located?  I 
> relied on
> reading other people's code that was written with libnet, but it was 
> often
> not applicable and I had to experiment around.
>
> Using the tcpdump arguments that you recommended, I was able to see 
> that you
> were right - the dest hw address was in fact incorrect, and this is
> undoubtedly the problem.  I was passing it the hw address reported on 
> the
> destination machine by ifconfig for my tests using LIBNET_LINK; 
> however, some
> other, unknown hw address was being sent when they were built with
> LIBNET_RAW4, which was making it to the destination.  Is there a simple
> function to look up the MAC address, or will I need to build and send 
> the ARP
> packets myself?  I suppose it's in the samples.
>
> Again, thank you for your help; it is greatly appreciated.
>
>  - Karen
>
> On Monday 17 January 2005 10:10 am, you wrote:
>> Well without any code, all I can say is you're doing something wrong.
>> First, it doesn't look like that you used the -e or -XX/-xx flag with
>> tcpdump to print the ethernet header to know where the packets are
>> actually going to.  However, I can make a guess:
>>
>> LIBNET_RAW4 will cause an ARP request to be made on your behalf to 
>> look
>> up the destination MAC address.  The ethernet header of the built
>> packet will then go to the correct address.
>>
>> LIBNET_LINK does NOT do an ARP request and expects you to provide the
>> dst MAC.  I'd guess that you put in the wrong dst MAC and hence it
>> isn't delivered to the target host.
>>
>> If you have other questions, you might want to check in the "samples"
>> directory for how to build packets with the LIBNET_LINK API.
>
>
--
Mike Schiffman, CISSP
http://www.packetfactory.net/schiffman
Doveryay No Proveryay