tcpdump mailing list archives

sending raw packet using pcap


From: "Chris sun" <lei_sun () comcast net>
Date: Mon, 10 Nov 2003 16:32:51 -0500

Hi :
  I was using pcap (libpcap-2003.10.21) to develop a set of protocol. The first thing came up is to make pcap writable, 
I followed Gary R. Wright's guide at http://www.kohala.com/start/writepcap.txt.

The only thing I did is modified pcap_bpf.c file and change the call to ope() from O_RDONLY to O_RDWR. than call 
write(pd->fd, .....) to write data into pcap.
I am running my test in RH linux 7.2, Interesting thing happened. If I write packet which size smaller than 60 bytes, 
the receving program will always capture packet sized 60 bytes.  anything greater than 60 bytes will showed up as 
actually buffer size I've written.  The frame I built is just ethernet header followed by  some other test data. 
In both cases. I got the correct ethernet header, but the following data is missing and replaced by some strange data. 
I don't know where it come from.

Anybody knows how could this happen? Does pcap automatically append ip or tcp header ? or whatever data ?
Thank you!
chris. 

Current thread: