[tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Chris Morgan
I'm working on a pcap/winpcap c# library, SharpPcap. I was wondering what the best way to get a devices mac address was, preferrably in a manner that would work in both pcap and with winpcap. So far I've seen code that captures packets on the interface and looks in them for the mac address, I've al

[tcpdump-workers] output timestamps in HEX format

2009-03-03 Thread NADEZHDA PLOTNIKOVA
hello, I am using the following string WinDump.exe -tt -nnr file.pcap but the time stamps I am getting in the output text file are in decimal format. Does anyone know how to make it in hex format? is it possible at all?   thank you!  - This is the tcpdump-workers list. Visit https://cod.sandelma

[tcpdump-workers] Working for IP over GTP

2009-03-03 Thread Ambika Tripathy
Hi Exports, I am new to libpcap/tcpdump application. I am trying to filter IP packets flowing over GTP-U header. If I assume the GTP-U header is only 8 bytes it works fine. But my problem is when GTP-U contains some extra data (gtp header length > 8) how I can determine the start IP header to

Re: [tcpdump-workers] Filter incoming or leaving packets

2009-03-03 Thread Johan Mazel
Hi Ok, I'm running libpcap 0.9.8-5 on Ubuntu 8.10. Despite that this function is in the man version of libpcap and that I don't have any compilation error, it looks like it's not working since I have have a segmentation error each time I try to launch a program with the funtion inside. I tried to u

Re: [tcpdump-workers] Filter incoming or leaving packets

2009-03-03 Thread Guy Harris
On Mar 3, 2009, at 9:49 AM, Johan Mazel wrote: Ok, I'm running libpcap 0.9.8-5 on Ubuntu 8.10. Despite that this function is in the man version of libpcap and that I don't have any compilation error, it looks like it's not working since I have have a segmentation error each time I try to la

[tcpdump-workers] reading a live pcap file in real time

2009-03-03 Thread Giovanni Venturi
Hello, I'm using libpcap 3.9.8. I made a GUI application under KDE that when I ask to start sniffing packets from the network, than it starts another application (not a GUI) that captures all the packets and write them into a file. From the GUI I have under control the file it writes. And I use

Re: [tcpdump-workers] reading a live pcap file in real time

2009-03-03 Thread Guy Harris
On Mar 2, 2009, at 3:42 PM, Giovanni Venturi wrote: I'm using libpcap 3.9.8. I made a GUI application under KDE that when I ask to start sniffing packets from the network, than it starts another application (not a GUI) that captures all the packets and write them into a file. Gee, there's

Re: [tcpdump-workers] reading a live pcap file in real time

2009-03-03 Thread Guy Harris
On Mar 3, 2009, at 11:06 AM, Guy Harris wrote: Look at the source of the "dumpcap" program in Wireshark for an example of how to do the capture side of that. The secret is that it doesn't just write to the file and not communicate with the program on whose behalf it's capturing - every ti

Re: [tcpdump-workers] output timestamps in HEX format

2009-03-03 Thread Guy Harris
On Mar 3, 2009, at 3:33 AM, NADEZHDA PLOTNIKOVA wrote: I am using the following string WinDump.exe -tt -nnr file.pcap but the time stamps I am getting in the output text file are in decimal format. Yes. "Unformatted" does not necessarily mean "hexadecimal". Does anyone know how to make i

Re: [tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > "Chris" == Chris Morgan writes: Chris> I'm working on a pcap/winpcap c# library, SharpPcap. I was Chris> wondering what the best way to get a devices mac address was, Chris> preferrably in a manner that would work in both pcap and w

Re: [tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Chris Morgan
On Tue, Mar 3, 2009 at 8:49 PM, Michael Richardson wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > >> "Chris" == Chris Morgan writes: >    Chris> I'm working on a pcap/winpcap c# library, SharpPcap. I was >    Chris> wondering what the best way to get a devices mac address was, >

Re: [tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Guy Harris
On Mar 3, 2009, at 6:44 PM, Chris Morgan wrote: I would be looking for the local adapter mac addresses. Under linux with pcap and the adapters I have, ethernet and wireless, I see hardware mac addresses in pcap_if_t.addresses. I wasn't sure if there were any known cases where pcap_if_t.address

Re: [tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Chris Morgan
On Tue, Mar 3, 2009 at 9:54 PM, Guy Harris wrote: > > On Mar 3, 2009, at 6:44 PM, Chris Morgan wrote: > >> I would be looking for the local adapter mac addresses.  Under linux >> with pcap and the adapters I have, ethernet and wireless, I see >> hardware mac addresses in pcap_if_t.addresses. I was

Re: [tcpdump-workers] Hardware mac address with pcap/winpcap

2009-03-03 Thread Guy Harris
On Mar 3, 2009, at 7:33 PM, Chris Morgan wrote: Right. I had to look at the sa_family value to differentiate the two under linux but I don't believe windows even has the same values for sa_family. The numerical values don't matter *if* you have the same #defined AF_ name for the family in w