RE: Question on SOCK_RAW, implement a bpf->other host tee

From: Don Bowman (don_at_sandvine.com)
Date: 07/17/04

  • Next message: Chuck Swiger: "Re: Question on SOCK_RAW, implement a bpf->other host tee" 
    To: Don Bowman <don@sandvine.com>, "'net@freebsd.org'" <net@freebsd.org>
Date: Sat, 17 Jul 2004 15:00:25 -0400

    From: Don Bowman [mailto:don@sandvine.com]
    > I'm trying to implement a 'tee' which reads
    > from bpf, and sends matching packets to
    > another layer-2 adjacent host.
    >

    Sorry to follow up my own post, but...
    More specifically, it appears the packet does
    try and transmit, but the destination MAC is
    (uninitialised?) somewhat random, different
    on each packet, not legal.

    I can capture it on the correct output interface
    with tcpdump. The interface type is xl.

    Shouldn't the stack ARP for the destination
    in my 'sendto', and fill in the ether header?
    The ether-source is filled in, presumably by
    the driver.

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Chuck Swiger: "Re: Question on SOCK_RAW, implement a bpf->other host tee"

    Relevant Pages

    • Re: bandwidth and multiple NICs
      ... ng_fec looks at the destination mac addresses to work out which NIC ... for that decision -- but that means the packet has to be an IP packet. ... useful to you it would have to hash on TCP port numbers instead. ... of consecutive TCP connections and not enough parallel ones. ...
      (comp.unix.bsd.freebsd.misc)
    • Re: [Full-disclosure] Promiscious Device Detection
      ... Technically, promiscuous mode only affects packet reception, so it is ... the packets that would have been filtered normally from the kernel, ... correct destination IP address for that host, ... filtered by the MAC (e.g. with a different destination MAC address). ...
      (Full-Disclosure)
    • Re: Promiscuous Mode
      ... packet with an IP matching its own if the destination MAC in the packet ... paragraph in the previous mail, ... what do network stacks (not NICs) typically do? ...
      (Pen-Test)
    • Re: [Full-disclosure] Promiscious Device Detection
      ... network device is in promiscious mode or not. ... Technically, promiscuous mode only affects packet reception, so it is pretty difficult to detect; however most packet sniffers will not hide the packets that would have been filtered normally from the kernel, so the kernel should react to e.g. a ping or SYN packet that has the correct destination IP address for that host, but would normally be filtered by the MAC (e.g. with a different destination MAC address). ...
      (Full-Disclosure)
    • Re: Strange pings from 127.0.0.1
      ... I know you said the MAC address is also spoofed but this might help anyway: ... that are reporting port scans to their network all of which have a source ... Infected host picks address as source address and sends Syn packet to ... TCP/IP stack receives packet, responds with reset (if there is nothing ...
      (Security-Basics)