[WinPcap-users] ignore outbound packets? / winpcap dev faq

[protocol 7]

Hello again everyone, I've run into a snag which I'm sure is pretty common. Here's exactly what I'm doing: I'm writing a UDP bridge tool which consists of two parts, which I'll describe. In the example, the 10.255.255.255 network exists seperately at two locations, and the only point of contact between the networks are a machine 169.0.0.1 on one end, and a machine 170.0.0.1 on the other end. The intent of the tool is to bridge the two 10.255.255.255 networks.

The server thread captures all UDP port 1234 traffic, which looks like:
src ip: 10.0.0.1
dst ip: 10.0.0.1 or 10.255.255.255
src udp port: 1234
dst udp port: 1234

It then rewrites the packet, changing the following before sending:
src ip: 169.0.0.1
dst ip: 170.0.0.1
src udp port: 4321
dst udp port: 4321

The listener thread captures all UDP port 4321 traffic, then rewrites it back to the original form (10.0.0.1 / 1234) and sends it to the local network. The problem is, when the listener sends the new packet to the local network, the server thread sees it and redelivers it to the source network. In effect, I'm ending up with two reflectors. Since I'm preserving the mac addresses in the packet, I can't filter out my own mac. Is there a flag of some kind that will mark already modified packets as such? i'm hoping for something that can be handled automagically by the packet filter built in to pcap.

I've gone over the docs/faqs and haven't been able to find anything, so I hope this question is appropriate for the list. If not, a quick pointer to where in the docs I should be looking would be great.

Thanks
Jason

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail



==================================================================
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/winpcap-users@winpcap.polito.it/

To unsubscribe use mailto: [EMAIL PROTECTED]?body=unsubscribe
==================================================================