[tcpdump-workers] Obtaining MAC on OSX using AF_LINK

2010-12-30 Thread Mathew Rowley
I am trying to understand how to get the MAC address when a pcap_addr family is of type AF_LINK. It seems that the pacap_addr.sa_data should be of type (struct sockaddr_dl*) but then the sockaddr_dl sdl_alen is of variable size (I was expecting), and LLADDR doesnt help much. Any insight? Here i

[tcpdump-workers] libpcap OSX problems

2010-12-29 Thread Mathew Rowley
I have been debugging why libpcap is unable to sniff packets in pcaprub (of metasploit) and have found a few things. Maybe some of you can enlighten me. 1. With this sample source - if the timeout variable is 0 in pcap_open_live, capturing does not work. Setting to >0 allows things to work. 2.