Hi Thanks for the reply. One more thing, if I am particular in getting the destination mac address, then is it better to run a pcap instance for each of the interfaces of the system??
-> if yes, then is there a way to optimize multiple instances of pcap??(because I have tried it, and multiple instances of pcap uses a lot of cpu power) Regards Ankith On Tue, Apr 26, 2011, Guy Harris <[email protected]> said: > > On Apr 26, 2011, at 3:45 AM, Ankith Agarwal wrote: > >> I am trying to capture incoming packets in all the interfaces using >> pcap. I just wanted to know if there is a way of finding the interface(mac >> address or name) from which the packet has arrived?? >> >> (As I am using the "any" interface, I am getting the linux cooked >> capture header in the packet and this header only contains the source mac >> address, but I wanted to know the destination mac address > > Then you can't use the "any" interface, because, for a PF_PACKET/SOCK_DGRAM > socket, which is what is used for the "any" interface, that information is > not supplied - that's why the header for DLT_LINUX_SLL packets: > > http://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL.html > > doesn't contain the destination address.- > This is the tcpdump-workers list. > Visit https://cod.sandelman.ca/ to unsubscribe. > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
