On Wed, Mar 17, 2021 at 04:53:09PM +0100, Pablo Neira Ayuso wrote: > On Wed, Mar 17, 2021 at 05:41:53PM +0300, ilker wrote: > > it only gives the source MAC address:( > > I need the destination MAC address.. I will use > > src_mac+dst_mac+ethertype and reconstruct the full ETH header. > > I tried > > nfq_get_physindev_name > > nfq_get_physoutdev_name > > nfq_get_indev_name > > nfq_get_outdev_name > > > > but neither of them gave me a MAC. > > A libpcap fanboy said that netfilter can not and libpcap can give.. I > > don't want to convert my code to pcap that is why I am looking for a > > solution. > > nfq_get_indev_name provides the input device. From userspace, you can > retrieve the destination MAC from the indev. The ethernet protocol is > coming in the ->hw_protocol field. I'm assuming your setup is a router, then destination MAC can be infered.
