Advanced

Reading Packets with libpcap Part 2

Posted by jayrfink on · Post a comment
systhread.net; By Jason (Jay) R Fink
Mail this story
Print this story

In the first part of the libpcap series a rudimentry packet reader (or sniffer) was built which could read and print tcp/ip traffic on a particular interface. In the second text a look at some simple checks of the data itself, adding options like interface selection, libpcap filter options and verbosity levels. Some of the checks included are:

  • IP Packet Truncation
  • IP Header Length
  • Ethernet Header Length

The filter options are eventually passed exactly like tcpdump using the tcpdump argv vector copy.

  Text

In the first part of the libpcap series a rudimentry packet reader (or sniffer) was built which could read and print tcp/ip traffic on a particular interface. In the second text a look at some simple checks of the data itself, adding options like interface selection, libpcap filter options

and verbosity levels. Some of the checks included are:



  • IP Packet Truncation
  • IP Header Length
  • Ethernet Header Length


The filter options are eventually passed exactly like tcpdump

using the tcpdump argv vector copy.



  Text

Full Story

  Nav
» Read more about: Story Type: News Story, Tutorial; Groups: Debian, Linux

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments

No comments yet. Be the first.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post