[Winpcap-users] mirroring Ethernet frames

Seifert Johannes Seifert.Johannes at fronius.com
Tue May 22 07:09:14 GMT 2007


Hi Sam,

> Are the frames you're mirroring addressed to you?
No, the frames are normally broadcast addressed but in some special cases they are addressed to someone else. So I can't be sure which destination Mac address they have.

> Are you mirroring the frames back out the same interface
Yes. Basically the function is that every frame, which goes into the interface should be send out by the the same interface after receiving. (every frame with the matching EtherTyp). I only take a look at the EtherTyp to decide if the frames should me "mirrored".

My goal is to implement the last Slave on a Ethernet bus system. That system should be similar to EtherCAT.

Regards,
Johannes




-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org]On Behalf Of
Sam.Fielden at L-3com.com
Sent: Montag, 21. Mai 2007 17:08
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] mirroring Ethernet frames


Are the frames you're mirroring addressed to you?
If yes, then the filter given will enable to filter out the one's you're
mirroring back, as they will not be addressed to you.

Are you mirroring the frames back out the same interface? Or forwarding
them out another?

I think I'm missing some key details of your goal.



-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Seifert Johannes
Sent: Monday, May 21, 2007 9:05 AM
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] mirroring Ethernet frames


Hi Sam,

I think you didn't ge me right. I wan't to mirror (sending exactly the
recived frames again) all recived Frames with an fixed Ethertype. I can
filter outh these frames with the filter: "ether proto 0x88A4". But to
avoid reciving the same frame again after sending, I need a filter that
only get the Frames from "outside".

Basically i need a funtion like "pcap_setmode(adhandle,PCAP_D_IN)", but
i seems that this function isn't implemented anymore.

Regards,
Johannes

-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org]On Behalf Of
Sam.Fielden at L-3com.com
Sent: Montag, 21. Mai 2007 15:11
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] mirroring Ethernet frames


>From the documentation:

"Capture Filter Syntax
---------------------

<clip/>

ether [src|dst] host <ehost>

This primitive allows you to filter on Ethernet host addresses. You can
optionally include the keyword src|dst between the keywords ether and
host to specify that you are only interested in source or destination
addresses. If these are not present, packets where the specified address
appears in either the source or destination address will be selected.

<clip/>
"

So I would imagine something like, "ether dst host <ehost>", where
<ehost> is the ethernet address of your machine, would serve your
purpose - have you considered this already??

Sam


-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Seifert Johannes
Sent: Monday, May 21, 2007 4:09 AM
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] mirroring Ethernet frames


Hi Sam,

thanks for your answer! I've searched the Documentation for this feature
and I found the keywords "inbound and outbound". It seems that these
keywords do exactly what I need. But if I define a filter like "inbound
and proto 0x88A4" it doesn't work and I have no idea why.

Thanks,
Johannes


-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org]On Behalf Of
Sam.Fielden at L-3com.com
Sent: Mittwoch, 16. Mai 2007 16:16
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] mirroring Ethernet frames


You need to use capture filters to achieve this. Take a look at the
documentation regarding "filters".

Sam

-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Seifert Johannes
Sent: Wednesday, May 16, 2007 4:14 AM
To: winpcap-users at winpcap.org
Subject: [Winpcap-users] mirroring Ethernet frames


Hi,

I've searched the internet for help but I didn't found a solution for
following problem: I've written a small program which simply mirrors the
received Ethernet frame, if the frame  hast a defined EtherTyp. That
means that the received frame is directly send after receiving. 
The problem is that the send telegram is interpreted as a received
telegram. Also it is possible that same frames are received from
"outside". That makes the solution with a buffer impossible.

My aim is that only the telegram's, which come from "outside", are
mirrored.

Thanks,
Johannes

Ps: sorry my English isn't the best.
 


_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users



_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users





More information about the Winpcap-users mailing list