We've been developing a virtual network device and now we are exporting it to the netfilter phylosophy. When capturing packets with libpcap (ethereal) we are not sure at which level the packet is got. I say so, cause when using netfilter we modify the packet information, and in ethereal the information displayed is the packet with the modifications (some private headers has been removed)
So there's our doubt. Where does libpcap capture the packet? Before or after the driver or after crossing all the ip stack? We want to see it as it's received from the network without any modifications, is it possible?
Any help is welcomed.
TA
--------------------------------------------
Jorge Lanza Calderón Departamento Ingeniería Comunicaciones Grupo de Ingeniería Telemática Universidad de Cantabria Avda. de los Castros, s/n 39005 - Santander (España) Tel: +34 942 200914 Fax: +34 942 201488 mailto:[EMAIL PROTECTED] Web: http://www.tlmat.unican.es
--------------------------------------------
- This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]