[Winpcap-users] mirroring Ethernet frames

[Seifert Johannes]

Hi Sam,

I think you didn't ge me right. I wan't to mirror (sending exactly the recived frames again) all recived Frames with an fixed Ethertype. I can filter outh these frames with the filter: "ether proto 0x88A4".
But to avoid reciving the same frame again after sending, I need a filter that only get the Frames from "outside".

Basically i need a funtion like "pcap_setmode(adhandle,PCAP_D_IN)", but i seems that this function isn't implemented anymore.

Regards,
Johannes

-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org]On Behalf Of
Sam.Fielden at L-3com.com
Sent: Montag, 21. Mai 2007 15:11
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] mirroring Ethernet frames


>From the documentation:

"Capture Filter Syntax
---------------------

<clip/>

ether [src|dst] host <ehost>

This primitive allows you to filter on Ethernet host addresses. You can
optionally include the keyword src|dst between the keywords ether and
host to specify that you are only interested in source or destination
addresses. If these are not present, packets where the specified address
appears in either the source or destination address will be selected.

<clip/>
"

So I would imagine something like, "ether dst host <ehost>", where
<ehost> is the ethernet address of your machine, would serve your
purpose - have you considered this already??

Sam


-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Seifert Johannes
Sent: Monday, May 21, 2007 4:09 AM
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] mirroring Ethernet frames


Hi Sam,

thanks for your answer! I've searched the Documentation for this feature
and I found the keywords "inbound and outbound". It seems that these
keywords do exactly what I need. But if I define a filter like "inbound
and proto 0x88A4" it doesn't work and I have no idea why.

Thanks,
Johannes


-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org]On Behalf Of
Sam.Fielden at L-3com.com
Sent: Mittwoch, 16. Mai 2007 16:16
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] mirroring Ethernet frames


You need to use capture filters to achieve this. Take a look at the
documentation regarding "filters".

Sam

-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Seifert Johannes
Sent: Wednesday, May 16, 2007 4:14 AM
To: winpcap-users at winpcap.org
Subject: [Winpcap-users] mirroring Ethernet frames


Hi,

I've searched the internet for help but I didn't found a solution for
following problem: I've written a small program which simply mirrors the
received Ethernet frame, if the frame  hast a defined EtherTyp. That
means that the received frame is directly send after receiving. 
The problem is that the send telegram is interpreted as a received
telegram. Also it is possible that same frames are received from
"outside". That makes the solution with a buffer impossible.

My aim is that only the telegram's, which come from "outside", are
mirrored.

Thanks,
Johannes

Ps: sorry my English isn't the best.
 


_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users