Hi!
In testing a small app using libpcap, I noticed differences in behaviour when using the loopback interface vs. using a hardware interface. In particular, it seems the packets coming in over the loopback interface are still in host byte order (little endian, in this case). Is that typical, or just an OS-dependent artifact? In trying to find the answer, I came across a function in the pcap library, pcap_datalink(). If I really wanted my app to work using the loopback interface, I assume I would use this function to determine whether or not to invoke byte order altering functions. But yikes, it really looks like it could get messy in a hurry. Do most people just not bother, or do they really attempt some kind of portability? Are there any clean examples?
TIA, Robert
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
