Re: Filter incoming or leaving packets

[Johan Mazel <johan.mazel () gmail com>]

Hi
Ok, I'm running libpcap 0.9.8-5 on Ubuntu 8.10.
Despite that this function is in the man version of libpcap and that I don't
have any compilation error, it looks like it's not working since I have have
a segmentation error each time I try to launch a program with the funtion
inside.
I tried to use it with something like this: pcap_setdirection(this->descr,
PCAP_D_IN); this->descr being a pcap_t * attribute of my class.
I also tried to replace PCAP_D_IN by a local variable of the
pcap_direction_t type and with the value of PCAP_D_IN.

I think that I will be forced to create a manual filter which will force the
absence of capture of any which comes from the mac address of the interface
considered.

Thanks for the help and the tips.
Johan Mazel

2009/2/27 Aaron Turner <synfinatic () gmail com>

> On Fri, Feb 27, 2009 at 6:53 AM, Johan Mazel <johan.mazel () gmail com>
> wrote:
> > Hello
> > I would like to know if there is a way to use pcap_compile() to filter
> only
> > incoming packets or only leaving packets in a host/network interface ?
> > I search in the snort doc and in this tutorial (
> > http://yuba.stanford.edu/~casado/pcap/section3.html<http://yuba.stanford.edu/%7Ecasado/pcap/section3.html>),
> I found stuff linked
> > to the filtering of packets coming or going from/to one host in
> particular
> > but nothing about incoming/leaving packets.
> > Thanks in advance for the help.
> > Johan Mazel
>
> That's a really old tutorial.  On some operating systems (I don't
> think it's fully cross platform) you can use
> pcap_setdirection().  In other cases, writing a BPF filter to look for
> packets with a source MAC of the listening host is good enough to get
> outbound only, while looking for anything else is good enough for
> inbound.
>
>
> --
> Aaron Turner
> http://synfin.net/
> http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix &
> Windows
> Those who would give up essential Liberty, to purchase a little
> temporary Safety,
> deserve neither Liberty nor Safety.
>    -- Benjamin Franklin
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.