Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Libnet
[Top] [All Lists]

Re: Code working with LIBNET_RAW4, not with LIBNET_LINK

Subject: Re: Code working with LIBNET_RAW4, not with LIBNET_LINK
Date: Tue, 18 Jan 2005 02:31:06 -0600
Thank you for your help.  First off, there are no samples that I could find - 
there were none included with the libnet on my system (installed from a FC3 
rpm), nor could I find any via google.  Where are they located?  I relied on 
reading other people's code that was written with libnet, but it was often 
not applicable and I had to experiment around.

Using the tcpdump arguments that you recommended, I was able to see that you 
were right - the dest hw address was in fact incorrect, and this is 
undoubtedly the problem.  I was passing it the hw address reported on the 
destination machine by ifconfig for my tests using LIBNET_LINK; however, some 
other, unknown hw address was being sent when they were built with 
LIBNET_RAW4, which was making it to the destination.  Is there a simple 
function to look up the MAC address, or will I need to build and send the ARP 
packets myself?  I suppose it's in the samples.

Again, thank you for your help; it is greatly appreciated.

 - Karen

On Monday 17 January 2005 10:10 am, you wrote:
Well without any code, all I can say is you're doing something wrong.
First, it doesn't look like that you used the -e or -XX/-xx flag with
tcpdump to print the ethernet header to know where the packets are
actually going to.  However, I can make a guess:

LIBNET_RAW4 will cause an ARP request to be made on your behalf to look
up the destination MAC address.  The ethernet header of the built
packet will then go to the correct address.

LIBNET_LINK does NOT do an ARP request and expects you to provide the
dst MAC.  I'd guess that you put in the wrong dst MAC and hence it
isn't delivered to the target host.

If you have other questions, you might want to check in the "samples"
directory for how to build packets with the LIBNET_LINK API.

<Prev in Thread] Current Thread [Next in Thread>