Hi, > > Dear sir/madam, > > I'm currently using your windump source code to develop a > software which will be used to detect instruder base on MAC address.
Do you mean WinPcap? Using windump as a starting base for such a software is not a great choice. > I have copied and paste one of your example in the Winpcap > documentation which filters only UDP packet. I have changed > the filter to "arp" then it now captures only ARP packet. > What I need to know is how to extract the source (or > destination) MAC address from those packets. Could you give > me a hint or recommend me any document to help me with that problem ? Since WinPcap delivers to the application the complete link-layer frames, the MAC addresses are the first bytes (usually 12) of the buffers that contain them. Loris > Best Regards, > > Tuan Ha > > > > ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[email protected]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
