----- Original Message -----
From: "Amit Kucheria" <amitk@ittc.ku.edu>
To: "James Stevenson" <mistral@stev.org>
Cc: <linux-net@vger.kernel.org>
Sent: Friday, December 14, 2001 7:22 PM
Subject: Re: libnet and arp
> On Fri, 14 Dec 2001, James Stevenson wrote:
>
> > promisc wont see a packet on a network unless its broadcast
> Yes it has a ethernet broadcast address.
ok so anything should see it.
> > are you putting an ethernet header above the arp packet ?
> sure...libnet takes care of it.
i have never used libnet but i have sene problems with "portable" libs
> > what happens when you construct them without using libnet ?
> not tried that yet...guess will have to do it now.
it should not take long just create a raw socket and send and
eth header and arp packet you should see it.
> I am creating these ARP packets on a 192.168.17.0 network.
> My ARP packets are as follows:
>
> Sender HA = 00:e0:29:31:97:74
> Target HA = 00:00:00:00:00:00
> Sender IP = 0.0.0.0
> Target IP = 0.0.0.0
>
> Ethernet header:
>
> Src address = 00:e0:29:31:97:74
> Dest address = ff:ff:ff:ff:ff:ff
>
> In other words, this is any ARP probe. since sender and target IP are set
> to zero to avoid corrupting caches on the network. Would this have an
> affect on sniffing?
as far as i can see this should work i am thinking it is a problem with
libnet
i have never used it but i have tried other libs that are meant todo the
same
things but i have always ened up creating my own structs etc.. because they
have created nothing but problems then if you need to make it portable you
only
need to change the socket type between certin OS's
James
-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
