>Hello all, > >I am libpcap newbie >I have some libpcap questions > >1. Does libpcap provide a method to capture all packets promiscuously and >simultaneously from all interfaces that are present on the machine.
An application using libpcap can only pick up packets (in promiscuous mode or not) from one NIC at a time (see tcpdump) What you can do is start multiple instances of the application that uses libpcap to monitor different NICs because pcap_open_live() can take only the name of one interface as an argument. >2. If yes can we get to know the captured packet is from which interface. So I guess you can figure out from which interface a packet is originated since there are going to be different instances of the application for each card. >3. Is the above operations portable across OS'es libpcap is portable accross different flavors of UNIX (e.g. Linux, HP-UX, SUNOS etc.) so it is up to the application above libpcap to determine the portability. If using Windows you need Winpcap http://www.netgroup.polito.it/WinPcap >4. Will libpcap give me packets that can have errors in layers above the >link layer. The packet driver picks up any packet that comes through the interface if there is an error above the link layer is up to the application to figure that out and not libpcap. > >Thanks in advance, > >Rgds, >Vishal Malhan Hope that helps! _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
