[tcpdump-workers] Format of libpcap packet
jesse.alan.johnson at gmail.com
Sat Mar 28 20:46:50 EDT 2015
I am dissecting pcap packets generated by airodump-ng using libpcap and
I seem to be offset on the access of the Ethernet fram. I am using the
call pcap_next_ex() and working with the returned ethernet packet. I
read the first destination and source MACs into a C array and they both
seem to be offset by one byte. For example, I get FF:FF:FF:FF:FF:D5 as a
destination MAC instead of FF:FF:FF:FF:FF:FF which would be a broadcast
Is the Ethernet frame returned by the call pcap_next_ex() and exact
replica of the original frame, no extra information inserted?
On a side note, does anyone see any value in porting the project to go?
It have started looking at the source to see if there are any "show
stoppers" and haven't seen any yet.
My end project is to perform big data analysis on very large samples of
network packets collected in open environments to test for correlations
or irregularities. To perform the analysis, I would like to get access
to the actual byte values of the Ethernet frame and IP headers.
Thank you for your assistance,
More information about the tcpdump-workers