Hi Ok in terms of the feature that I wanted to use... Is there a command that libpcap can use to detect lost packets?\
Thanks Vossie ----- Original Message ----- From: "Guy Harris" <[EMAIL PROTECTED]> To: <tcpdump-workers@lists.tcpdump.org> Sent: Thursday, October 20, 2005 4:51 PM Subject: Re: [tcpdump-workers] more advanced feature of libpcap? > Vossie wrote: > > > I wanted libpcap to do the following: It must distinguish between > > packets that have been sent from its monitoring network card and between > > packets that was received on its monitoring network card. > > "Distinguish between" those packets in what sense? Do you mean you want > libpcap to indicate, when it supplies a packet to an application that's > capturing packets with libpcap, whether the packet was sent by, or > received by, the machine running the application? > > If so, it would be possible to extend libpcap to do so on *some* > platforms, but not on others; libpcap doesn't itself contain code to do > the raw packet capturing, it just uses whatever mechanism the UN*X on > which it's running provides for that purpose, and if that mechanism > doesn't supply an indication of packets sent vs. packets received, > libpcap can't supply it, either. > > Such a change would require a new API, as the current API doesn't have > any place to provide that information (changing "struct pcap_pkthdr" > would only work if applications checked, at compile time, whether that > structure had a new field with that information *AND*, if it does, > *ALSO* checked, at run time, whether it was running with a version of > libpcap that had it, because if they're dynamically linked with libpcap > they might be using an older version of libpcap than the one with which > they were built). > > > Is it possible? I want to use it to see packet lost. > > "See packet lost" in what sense? > > > Example: You ping a given ip address. Now lets say the packet gets > > lost i.e your network card does not get a reply. After the timeout your > > network card resend the same packet again. > > So how would distinguishing between packets sent by the machine running > the libpcap-based application, and packets received by that machine, > help here? > > Note also that pinging generally is done by the host, *not* by the > network card, unless your network card not only offloads IP but also > offloads ICMP *and* pinging - do *any* network cards do that? Pinging > would usually be done by the "ping" program or some other such > application, which would do the retransmission, and the capture > application would see the original ping and the retransmission. > - > This is the tcpdump-workers list. > Visit https://lists.sandelman.ca/ to unsubscribe. > - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
