On Apr 04 21:03:58, Alessandro Baggi wrote:
> Hi list. I'm coding a little program with libpcap that captures ARP
> packet.
Why? tcpdump arp
> In this program I try to cast an arphdr struct pointer to
> the packet, to read ARP packet parameters, and in this point I have
> the problem.
tcpdump -e arp
If you are sure you need to write your own code for this,
look at the source of tcpdump to see how they do it.
> This is the code of the callback pcap_loop function:
>
> void mac(u_char *args, const struct pcap_pkthdr *header, const
> u_char *packet)
> {
> struct arphdr *arp = NULL;
> arp = (struct arphdr *) packet;
> printf("%d:%d:%d\n", arp->ar_sha[0], arp->ar_sha[1],
> arp->ar_sha[2]);
> return;
> }
>
> Compiling this source, I get the following error:
>
> oad-cap.c: In function 'mac':
> oad-cap.c:11: error: 'struct arphdr' has no member named 'ar_sha'
> oad-cap.c:11: error: 'struct arphdr' has no member named 'ar_sha'
> oad-cap.c:11: error: 'struct arphdr' has no member named 'ar_sha'
>
> Now, I've seen in /usr/include/net/if_arp.h and get:
>
> struct arphdr {
> u_int16_t ar_hrd; /* format of hardware address */
> #define ARPHRD_ETHER 1 /* ethernet hardware format */
> #define ARPHRD_IEEE802 6 /* IEEE 802 hardware format */
> #define ARPHRD_FRELAY 15 /* frame relay hardware format */
> #define ARPHRD_IEEE1394 24 /* IEEE 1394 (FireWire) hardware format */
> u_int16_t ar_pro; /* format of protocol address */
> u_int8_t ar_hln; /* length of hardware address */
> u_int8_t ar_pln; /* length of protocol address */
> u_int16_t ar_op; /* one of: */
> #define ARPOP_REQUEST 1 /* request to resolve address */
> #define ARPOP_REPLY 2 /* response to previous request */
> #define ARPOP_REVREQUEST 3 /* request protocol address given
> hardware */
> #define ARPOP_REVREPLY 4 /* response giving protocol address */
> #define ARPOP_INVREQUEST 8 /* request to identify peer */
> #define ARPOP_INVREPLY 9 /* response identifying peer */
> /*
> * The remaining fields are variable in size,
> * according to the sizes above.
> */
> #ifdef COMMENT_ONLY
> u_int8_t ar_sha[]; /* sender hardware address */
> u_int8_t ar_spa[]; /* sender protocol address */
> u_int8_t ar_tha[]; /* target hardware address */
> u_int8_t ar_tpa[]; /* target protocol address */
> #endif
> };
>
> I've tried to #define COMMENT_ONLY, with no result. But I think that
> the solution is not #define COMMENT_ONLY.
> I've searched on google, same with no result.
> Someone know what it does depend?
>
> Thanks in advance.
