Re: Hardware mac address with pcap/winpcap

[Guy Harris <guy () alum mit edu>]

On Mar 3, 2009, at 7:33 PM, Chris Morgan wrote:

> Right. I had to look at the sa_family value to differentiate the two
> under linux but I don't believe windows even has the same values for
> sa_family.

The numerical values don't matter *if* you have the same #defined AF_  
name for the family in which you're interested - but that's not  
guaranteed to be the case (it's not even guaranteed that the name for  
whatever AF_ value Linux uses is *defined* by Windows).

> Some users have expressed the
> desire to get the hardware mac addresses, I think so they can send
> packets, but maybe this will be filled in by the kernel or the
> hardware.

Not necessarily - on systems with BPF (*BSD, Mac OS X), libpcap turns  
on an option to cause the kernel and driver to just pass through  
whatever source address is in the header of the packet being  
transmitted (and turn it off on versions of Mac OS X where that option  
doesn't work, if it causes a send to fail, and then retry the send).

> Is the development of pcap such that such a feature might be present
> in the next several months?

Possibly, but it's unlikely to be there soon.

> Even something that would work on WinXP
> and beyond and Linux with a newish kernel would be great, although I
> don't assume that pcap and winpcap are developed by the same people.

There are some WinPcap developers on the libpcap core team, and there  
is at least one libpcap core developer who, although not a WinPcap  
developer, at least tries to keep WinPcap in mind when developing  
features and updates pcap-win32.c when required and possible.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.