Prepend Ethernet header

[lance...@yahoo.com]

Hi all,

I'm looking for a way to prepend Ethernet headers to packets of the
form

IP -> payload

and have the resulting packets (Eth -> IP -> payload) be of libpcap
format.

I've used text2pcap before, but I don't want to have to convert the IP
packets to text-form first.

Is there anything in the libpcap library that could do this?

Thank you.

Regards,
Rayne

[Jorgen Grahn]

On Wed, 2009-10-14, lance...@yahoo.com wrote:
> Hi all,
>
> I'm looking for a way to prepend Ethernet headers to packets of the
> form
>
> IP -> payload
>
> and have the resulting packets (Eth -> IP -> payload) be of libpcap
> format.

Why? If you just want to make a valid pcap(3) file of it, consider
the type DLT_RAW. That's a subformat where each packet is an IP packet
(or IPv6 I suppose), not a link-layer frame. Tools should generally
accept that file format.

But maybe you need the link layer headers.

> I've used text2pcap before, but I don't want to have to convert the IP
> packets to text-form first.
>
> Is there anything in the libpcap library that could do this?

libpcap doesn't do much with the frames themselves ... but you can
earily use it to write a program which reads IP packets and writes
Ethernet frames by prepending a hand-made Ethernet header.

/Jorgen

--
// Jorgen Grahn <grahn@ Oo o. . .
\X/ snipabacken.se> O o .

[Jorgen Grahn]

On Wed, 2009-10-14, Jorgen Grahn wrote:
> On Wed, 2009-10-14, lance...@yahoo.com wrote:
>> Hi all,
>>
>> I'm looking for a way to prepend Ethernet headers to packets of the
>> form
>>
>> IP -> payload
>>
>> and have the resulting packets (Eth -> IP -> payload) be of libpcap
>> format.
>
> Why? If you just want to make a valid pcap(3) file of it, consider
> the type DLT_RAW. That's a subformat where each packet is an IP packet
> (or IPv6 I suppose), not a link-layer frame. Tools should generally
> accept that file format.
>
> But maybe you need the link layer headers.

And I mention it mostly because I have myself spent a lot of time
producing fake Ethernet headers because I thought a pcap file needed a
link-layer header in order to be valid. It took me a year or two to
find DLT_RAW.

[lance...@yahoo.com]

I do need a link-layer frame.

So I can simply prepend a dummy 14-byte Ethernet header to the IP
packet and the entire packet can be read by tools like wireshark?

[lance...@yahoo.com]

Is it also possible to create a new packet using libpcap?

[Jorgen Grahn]

On Thu, 2009-10-15, lance...@yahoo.com wrote:
> Is it also possible to create a new packet using libpcap?

Please quote properly -- it makes life easier for whoever wants to help.

Yes, to both questions.

When you use libpcap, you just read packets as octet buffers, and you
also write them as octet buffers. You can put anything in there -- as
long as it matches the pcap file's link layer type (if the file claims
to be DLT_EN10MB, there must be an Ethernet header and so on). See the
pcap(3) man page for details.