On Sunday, September 23, 2018 at 10:20 AM, Guy Harris wrote: > On Sep 23, 2018, at 4:37 AM, Reznicencu Sergiu > <[email protected]> wrote: > > > I forgot to mention that I already recalculate the ip checksum. It is weird > > that > I cann see in wireshark the packets that I modified and resnt. Shouldn't the > packets be in "loopback"? > > On most UN*Xes, yes; they will show up on the loopback interface (lo0 or lo). > > On Windows, there isn't such an interface. WinPcap doesn't capture that > traffic;
Actually, WinPcap, by default, does capture all traffic you transmit using pcap_sendpacket() on a pcap_t handle (unless you're filtering to exclude it). That transmitted traffic will in fact be received by the host system's network Stack (presuming matching MAC and IP address values on the interface your pcap_t handle is connected to). This receipt will be in addition to the fact that the host system's network stack will also have received the original traffic which you've rewritten. WinPcap is not a facility that will let you capture traffic and inhibit its reception by the host system's network stack. - Mark Pizzolato _______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
