Re: inject & read from the same interface

[Guy Harris <guy () alum mit edu>]

On Mar 2, 2011, at 2:49 AM, Tobias C Rittweiler wrote:

> Is this expected behavior?

The only thing I'd expect in this case is whatever the particular mechanism atop which libpcap runs on a particular OS 
does; that may well differ from OS to OS.

> I'm also interested what in pcap-linux.c makes the first behavior
> take place (the silent filtering of the injected packet)

Probably its use of PF_PACKET sockets to capture and send traffic.  Now, whether there's another mechanism that 
provides the behavior you want (and is equally usable for the purposes of libpcap), or whether there's a way to 
configure a PF_PACKET socket so that it provides as input on that socket packets sent on that socket, is another matter.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.