From owner-freebsd-net@FreeBSD.ORG Sat May 21 16:36:41 2005 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B42C616A4CE for ; Sat, 21 May 2005 16:36:41 +0000 (GMT) Received: from smtpout.mac.com (smtpout.mac.com [17.250.248.97]) by mx1.FreeBSD.org (Postfix) with ESMTP id 477ED43DA3 for ; Sat, 21 May 2005 16:36:41 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from mac.com (smtpin02-en2 [10.13.10.147]) id j4LGafaZ005267; Sat, 21 May 2005 09:36:41 -0700 (PDT) Received: from [192.168.1.101] (pool-68-161-53-96.ny325.east.verizon.net [68.161.53.96]) (authenticated bits=0)j4LGad1C028446; Sat, 21 May 2005 09:36:40 -0700 (PDT) In-Reply-To: <20050521031625.77340.qmail@web53907.mail.yahoo.com> References: <20050521031625.77340.qmail@web53907.mail.yahoo.com> Mime-Version: 1.0 (Apple Message framework v622) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Charles Swiger Date: Sat, 21 May 2005 12:36:33 -0400 To: Daniel Valencia X-Mailer: Apple Mail (2.622) cc: freebsd-net@freebsd.org Subject: Re: sending MAC packets --- again, and again X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 May 2005 16:36:41 -0000 On May 20, 2005, at 11:16 PM, Daniel Valencia wrote: > I know this may sound funny, but I'm still wrestling > with libpcap because I send packets and I cannot read > them. I tried also some example code of a toy sniffer > from a tutorial to pcap, and it behaves just like my > code. As my code is pretty compact, I'm posting it > here. What you need to do is run "tcpdump -envvvX" and take a careful look at the packets being sent. In particular, watch out for packets containing something like this: "[bad tcp cksum 9f96 (->e867)!]", this generally means you have misconstructed the packet-- watch out for required padding to align the start of each protocol block. However, you really need to run this command from another machine in order to see what is really going out on the wire, running tcpdump locally means it intercepts the traffic while it is still being processed by the stack, and TXCSUM hardware or the like might change things... -- -Chuck