I wanted to update progress on this.
pcap_create("any", errb);
pcap_create("all", errb);
both succeed. If "all" works for linux then we would seem to be done.
Here is a link to some nice code on discovery from winpcap:
Winpcap discovery
code.<http://www.winpcap.org/docs/docs_412/html/group__wpcap__tut2.html>I
used it as a base below. First though --
Using the WSAIoctl(....) code below on my win xp ipv4 only system --
//rhm
{char *dev, errb[1024], wrk[1024];
#include "win32/include/net/if.h"
#include "ws2tcpip.h"
#include "ws2def.h"
struct ifconf ifc;
int fd, i;
int nNumInterfaces;
u_long nFlags;
SOCKET sd;
INTERFACE_INFO InterfaceList[20];
unsigned long nBytesReturned;
PSOCKADDR_IN pAddress;
sd = WSASocket(AF_INET, SOCK_DGRAM, 0, 0, 0, 0);
if (sd == SOCKET_ERROR) {
g_info("WSASocket %s", WSAGetLastError());
}
if (WSAIoctl(sd, SIO_GET_INTERFACE_LIST, 0, 0, &InterfaceList,
sizeof(InterfaceList), &nBytesReturned, 0, 0) == SOCKET_ERROR)
{
g_info("Failed calling WSAIoctl: error %s" ,WSAGetLastError());
}
nNumInterfaces = nBytesReturned / sizeof(INTERFACE_INFO);
g_info("There are %d" , nNumInterfaces);
for ( i = 0; i < nNumInterfaces; ++i) {
pAddress = (PSOCKADDR_IN) & (InterfaceList[i].iiAddress);
g_info(" %s" , inet_ntoa(pAddress->sin_addr));
pAddress = (PSOCKADDR_IN) & (InterfaceList[i].iiBroadcastAddress);
g_info(" has bcast %s" , inet_ntoa(pAddress->sin_addr));
pAddress = (PSOCKADDR_IN) & (InterfaceList[i].iiNetmask);
g_info( " and netmask %s" , inet_ntoa(pAddress->sin_addr));
nFlags = InterfaceList[i].iiFlags;
g_info(" Iface is %s", (nFlags & IFF_UP) ? "up" : "down");
if (nFlags & IFF_POINTTOPOINT) g_info(" %s ", " is
point-to-point");
if (nFlags & IFF_LOOPBACK) g_info(" %s ", " is a loopback
iface");
if (nFlags & IFF_BROADCAST) g_info(" %s ", "bcast ");
if (nFlags & IFF_MULTICAST) g_info(" %s" , "multicast ");
}
closesocket(sd);
}
//rhm
results in the following:
** INFO: There are 2
** INFO: 192.168.1.4
** INFO: has bcast 255.255.255.255
** INFO: and netmask 255.255.255.0
** INFO: Iface is up
** INFO: bcast
** INFO: multicast
** INFO: 127.0.0.1
** INFO: has bcast 255.255.255.255
** INFO: and netmask 255.0.0.0
** INFO: Iface is up
** INFO: is a loopback iface
** INFO: bcast
** INFO: multicast
So the interfaces are up, but which interface?
Based on the win pcap code, I did the following:
//rhm debug
{
pcap_if_t *alldevs = NULL;
pcap_if_t *d;
pcap_addr_t *ad = NULL;
int cnt = 0;
if (pcap_findalldevs(&alldevs, errbuf) == -1)
{
g_warning("Error in pcap_findalldevs: %s\n", errbuf);
}
else {
/* Print the list */
for(d=alldevs; d; d=d->next)
{
g_warning("%d. %s", ++cnt, d->name);
if (d->description)
g_warning(" (%s) ", d->description);
else
g_warning(" (No description available)\n");
g_warning((d->flags & PCAP_IF_LOOPBACK) ? "PCAP_IF_LOOPBACK\n"
: "~PCAP_IF_LOOPBACK");
for(ad = d->addresses; ad; ad=ad->next ) {
if(ad->addr->sa_family == AF_INET6) {
g_warning(" AF_INET6 ");
} else if (ad->addr->sa_family == AF_INET) {
g_warning(" AF_INET ");
}else {
g_warning(" AF UNKNOWN ");
continue;
}
}
}
}
if(alldevs) pcap_freealldevs(alldevs);
}
//rhm debug
and I got the following (on the same system):
**: 1. \Device\NPF_GenericDialupAdapter
**: (Adapter for generic dialup and VPN capture)
**: ~PCAP_IF_LOOPBACK
**: 2. \Device\NPF_{F3D02418-F9B1-45B2-B7E6-CD82AEEFDA09}
**: (Macronix MX98715-Based Ethernet Adapter (Generic) - Packet
Scheduler Miniport)
**: ~PCAP_IF_LOOPBACK
**: AF_INET
**: 3. \Device\NPF_{6A452F03-14BC-45EB-A6E6-0261AB51273B}
**: (Bluetooth PAN Network Adapter NDIS Driver (Microsoft's Packet
Scheduler) )
**: ~PCAP_IF_LOOPBACK
**: 4. \Device\NPF_{315593D2-B894-47E9-8495-4942A34BE634}
**: (Realtek 10/100/1000 Ethernet NIC (Microsoft's Packet Scheduler) )
**: ~PCAP_IF_LOOPBACK
**: AF_INET
Two AF_INET devices, only the last has a cable attached.
It all may go on the scrap heap if "all" works.
Roger
On Wed, Mar 13, 2013 at 11:14 PM, Alan Robertson <[email protected]> wrote:
> On 3/13/2013 2:03 PM, Alan Robertson wrote:
>
> On 03/13/2013 08:37 AM, Roger Massey wrote:
>
>
> Some of my changes were probably not windows specific but more ipv6-ipv4.
>
> One interesting thing - pcap_create("eth0" ...) doesn't work (I need
> to try "any" or "all"). What does work for me is the ever popular
> pcap_create("\\Device\\NPF_{6A452F03-14BC-45EB-A6E6-0261AB51273B}"
> ...). Getting a list of these things is easy but pragmatically picking
> the right one is not (I chose the one that works manually).
>
>
> Here's someone asking related questions:
> http://stackoverflow.com/questions/380990/network-interface-settings
>
> And he's referred to the "IP Helper" APIs...
>
> http://msdn.microsoft.com/en-us/library/aa366073(VS.85).asp<http://msdn.microsoft.com/en-us/library/aa366073%28VS.85%29.aspx>
> x
>
> Don't know if that helps or not...
>
> _______________________________________________
> Assimilation mailing list - Discovery-Driven Monitoring
> [email protected]
> http://lists.community.tummy.com/cgi-bin/mailman/listinfo/assimilation
> http://assimmon.org/
>
>
_______________________________________________
Assimilation mailing list - Discovery-Driven Monitoring
[email protected]
http://lists.community.tummy.com/cgi-bin/mailman/listinfo/assimilation
http://assimmon.org/
