On Fri, 14 Dec 2001, James Stevenson wrote:
> promisc wont see a packet on a network unless its broadcast
Yes it has a ethernet broadcast address.
> are you putting an ethernet header above the arp packet ?
sure...libnet takes care of it.
> what happens when you construct them without using libnet ?
not tried that yet...guess will have to do it now.
> are you sure you are sending them out the correct type of socket ?
again, libnet handles it.
I am creating these ARP packets on a 192.168.17.0 network.
My ARP packets are as follows:
Sender HA = 00:e0:29:31:97:74
Target HA = 00:00:00:00:00:00
Sender IP = 0.0.0.0
Target IP = 0.0.0.0
Ethernet header:
Src address = 00:e0:29:31:97:74
Dest address = ff:ff:ff:ff:ff:ff
In other words, this is any ARP probe. since sender and target IP are set
to zero to avoid corrupting caches on the network. Would this have an
affect on sniffing?
--
The statement below is true.
The statement above is false.
^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^
Amit Kucheria
EECS Grad. Research Assistant
University of Kansas @ Lawrence
(R)+1-(785)-830 8521 ||| (O)+1-(785)-864 7774
____________________________________________________
-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
