On 08/13/2013 04:08 PM, PP QQ wrote:
Hi,
I have tested netsniff-ng capturing packets on my "lo" device using the command
below:
sudo netsniff-ng --in lo --out netsniff_dump.pcap -s -T 0xa1b2c3d4
The problem is that when I open the pcap file using Wireshark, all captured packets are
duplicate and I have exactly twice the number of packets that have replayed on
"lo" using tcpreplay!
However, when I capture packets on my "eth0"no such problem is encountered.
Yes, that is correct. This is because of the nature of the loopback interface.
You send a packet out, the pf_packet tap gets it, it is being received, it gets
it as well. Hence, you'll see the packet twice. That's of course not the case on
real interfaces like eth0 and the like. Likely that libpcap handles this case
differently than we do.
You could try out to the above command: --type host
I also captured the same packets (on my "lo") by a small C program that I have written
which utilizes "libpcap" library. With libpcap everyting is fine and no packet
duplication is observed.
Thanx 4 your help in advance.
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
