Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: Code working with LIBNET_RAW4, not with LIBNET_LINK |
|---|---|
| Date: | Tue, 18 Jan 2005 02:31:06 -0600 |
Thank you for your help. First off, there are no samples that I could find - there were none included with the libnet on my system (installed from a FC3 rpm), nor could I find any via google. Where are they located? I relied on reading other people's code that was written with libnet, but it was often not applicable and I had to experiment around. Using the tcpdump arguments that you recommended, I was able to see that you were right - the dest hw address was in fact incorrect, and this is undoubtedly the problem. I was passing it the hw address reported on the destination machine by ifconfig for my tests using LIBNET_LINK; however, some other, unknown hw address was being sent when they were built with LIBNET_RAW4, which was making it to the destination. Is there a simple function to look up the MAC address, or will I need to build and send the ARP packets myself? I suppose it's in the samples. Again, thank you for your help; it is greatly appreciated. - Karen On Monday 17 January 2005 10:10 am, you wrote:
Well without any code, all I can say is you're doing something wrong. First, it doesn't look like that you used the -e or -XX/-xx flag with tcpdump to print the ethernet header to know where the packets are actually going to. However, I can make a guess: LIBNET_RAW4 will cause an ARP request to be made on your behalf to look up the destination MAC address. The ethernet header of the built packet will then go to the correct address. LIBNET_LINK does NOT do an ARP request and expects you to provide the dst MAC. I'd guess that you put in the wrong dst MAC and hence it isn't delivered to the target host. If you have other questions, you might want to check in the "samples" directory for how to build packets with the LIBNET_LINK API.
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Code working with LIBNET_RAW4, not with LIBNET_LINK, Aaron Turner |
|---|---|
| Next by Date: | libnet NG vs. libnet and Python bindings..., George V. Neville-Neil |
| Previous by Thread: | Re: Code working with LIBNET_RAW4, not with LIBNET_LINK, Aaron Turner |
| Next by Thread: | Re: Code working with LIBNET_RAW4, not with LIBNET_LINK, Aaron Turner |
| Indexes: | [Date] [Thread] [Top] [All Lists] |