I've just discovered libnet, and have been working on some test programs to
become familiar with it; it looks great. I've worked my way through a number
of stumbling blocks, and have gotten most of what I have attempted to do
working; however, I cannot figure out, nor can find anything online about
this current problem.
I have two versions of the same code; one builds a packet with a UDP header
and an IP header on LIBNET_RAW4 mode; the other builds a packet with a UDP
header, an IP header, and the underlying ethernet header on LIBNET_LINK mode.
tcpdump -w shows the output on the wire of the two commands as being
identical; however, only the RAW4 version makes it to its destination.
Here's a snippet from two tcpdump runs:
Without link:
00004CA0 0C 3A EB 41 E3 40 0B 00 34 00 00 00 34 00 00
00 .:.A.@..4...4...
00004CB0 00 20 E0 35 54 40 00 50 04 6C E7 30 08 00 45
00 . .5T@.P.l.0..E.
00004CC0 00 26 00 F2 00 00 40 11 A9 B7 C0 A8 00 03 81
FF .&....@.........
00004CD0 8D 73 75 30 00 50 00 08 BA 3F 01 02 03 04 05
06 .su0.P...?......
00004CE0 74 65 73 74
With link:
00004B50 40 3A EB 41 E1 A5 0E 00 34 00 00 00 34 00 00 00
@:.A....4...4...
00004B60 00 20 E0 35 54 40 00 50 04 6C E7 30 08 00 45
00 . .5T@.P.l.0..E.
00004B70 00 26 00 F2 00 00 40 11 A9 B7 C0 A8 00 03 81
FF .&....@.........
00004B80 8D 73 75 30 00 50 00 08 BA 3F 01 02 03 04 05
06 .su0.P...?......
00004B90 74 65 73 74
**Unknown header**:
Byte 0 is different
Bytes 1 through 3 are the same
Bytes 4 through 6 are different
Bytes 7 through 15 are the same
**Ethernet header**:
dhost: 00 20 E0 35 54 40
shost: 00 50 04 6C E7 30
type: 08 00
**IP header**:
version: 4
ihl: 5
tos: 00
tot_len: 00 26
id: 00 F2
frag_off: 00 00
ttl: 40
proto: 11
check: A9 B7
saddr: C0 A8 00 03
daddr: 81 FF 8D 73
**UDP header**:
Proper source: 75 30
Proper dest: 00 50
Proper length: 00 08
Proper check: BA 3F
**Data**:
Proper data: 01 02 03 04 05 06 74 65 73 74
There is one header that I'm not sure what it is, and what it's for; the only
differences between the RAW and LINK versions are in these 15 bytes of data.
Also, I don't know for certain that this data is a header; it could equally
well be at the end of the packets, as the output runs end on end.
Does anyone have any clue what's wrong, and what's going on here? I'd be very
appreciative. :)
- Karen Pease
