chenatu <notificati...@github.com> wrote: > use pcap_setdirection to capture the incoming packets but get some > errors I cannot understand. So I want to know how libpcap distinguish > the incoming of outgoing packets? Does it judge from the MAC address or > it can get directly from receiving buffer on duplex mode. My OS is > linux, CentOS 5.5. The NIC is set to promiscuous mode.
It is based upon whether it is copied from the RX or TX queue. If you have a NIC in promiscuous mode on an actual half-duplex media (e.g. coax) or a switch with a mirror port, and your NIC will receive packets it transmits, then you might see everything twice. (UserModeLinux virtual switches do exactly this, btw) It is very unlikely that you will hear your own packets on systems and technology made in the last 20 years. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | network architect [ ] m...@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers