[Winpcap-users] mirroring Ethernet frames

[Ioan Popescu]

Seifert Johannes wrote:
> Hi Sam,
> 
> I think you didn't ge me right. I wan't to mirror (sending exactly the recived frames again) all recived Frames with an fixed Ethertype. I can filter outh these frames with the filter: "ether proto 0x88A4".
> But to avoid reciving the same frame again after sending, I need a filter that only get the Frames from "outside".
> 
> Basically i need a funtion like "pcap_setmode(adhandle,PCAP_D_IN)", but i seems that this function isn't implemented anymore.
> 
> Regards,
> Johannes

Your application seems to be acting like a repeater (maybe for a signal
booster or something). Have you tried the PCAP_OPENFLAG_NOCAPTURE_LOCAL flag
for pcap_open()?

Docs at:
http://www.winpcap.org/docs/docs_40/html/group__remote__open__flags.html

It's supposed to *not* capture traffic you generate. I can't say for sure
how it interacts with promiscuous mode. Maybe someone else knows.