On Nov 15, 2009, at 11:56 PM, d00fy wrote:
hi all, recently I captured packets from ethernet with libpcap, I
found out that packets which were caputred with
pcap_open_live("any", ...)seem like strange, there are two bytes new
at mac header
There is no MAC header for packets captured on t
Linux cooked capture; aka SLL. It's a way of dealing with possible
differences in the link layer across 'any' (i.e., all) devices.
I think the code you want to look at is in pcap-linux.c .
2009/11/16 d00fy
> hi all, recently I captured packets from ethernet with libpcap, I found out
> that pac
hi all, recently I captured packets from ethernet with libpcap, I found out
that packets which were caputred with pcap_open_live("any", ...)seem like
strange, there are two bytes new at mac header, for instance:
00 00 00 01 00 06 00 1e c9 56 f8 a2 f1 00 08 00
but packets which were captured w
