On Wed, Mar 17, 2021 at 05:41:53PM +0300, ilker wrote: > it only gives the source MAC address:( > I need the destination MAC address.. I will use > src_mac+dst_mac+ethertype and reconstruct the full ETH header. > I tried > nfq_get_physindev_name > nfq_get_physoutdev_name > nfq_get_indev_name > nfq_get_outdev_name > > but neither of them gave me a MAC. > A libpcap fanboy said that netfilter can not and libpcap can give.. I > don't want to convert my code to pcap that is why I am looking for a > solution. nfq_get_indev_name provides the input device. From userspace, you can retrieve the destination MAC from the indev. The ethernet protocol is coming in the ->hw_protocol field.
