Re: info on DATA field of InfiniteSource

2011/9/30 Cliff Frey <[email protected]>:
> This works for me:
> click -e '
> InfiniteSource(DATA "packet contents here are ascii", LIMIT 1, STOP true)
> -> UDPIPEncap(192.168.1.2, 1000, 10.0.0.2, 2000)
> -> IPPrint(PAYLOAD ascii)
> -> Discard
> '

thanks, that worked!

i now have another question. i'm playing with REALLY simple
configurations, that is something like this

InfiniteSource(DATA "Hello world", LIMIT 5, STOP true)
        -> UDPIPEncap(192.168.1.2, 1000, 10.0.0.2, 2000)
        -> ciph :: CheckIPHeader(BADSRC 192.168.1.2)

ciph[0] -> ToDump(correct.dump, ENCAP IP)
ciph[1] -> ToDump(wrong.dump, ENCAP IP)

even if there are no correct packets (all match the BADSRC rule), i
end up having two dump files. the wrong.dump contains (correctly) all
the packets (i can see that from wireshark). the correct.dump file is
not readable from wireshark or tcpdump, is 24 bytes long, and contains
the following hexadecimal code

 D4 C3 B2 A1  02 00 04 00   00 00 00 00  00 00 00 00  D0 07 00 00  65 00 00 00


why is that file created, what does that mean?

luca
-- 
Chiave pubblica http://luca.costantino.googlepages.com/luca.costantino.asc

Prima di tutto vennero a prendere gli zingari e fui contento, perché
rubacchiavano.
Poi vennero a prendere gli ebrei e stetti zitto, perché mi stavano antipatici.
Poi vennero a prendere gli omosessuali, e fui sollevato, perché mi
erano fastidiosi.
Poi vennero a prendere i comunisti, e io non dissi niente, perché non
ero comunista.
Un giorno vennero a prendere me, e non c’era rimasto nessuno a protestare.
(Martin Niemöller)