From: grahn+nntp@snipabacken.se   
      
   On Wed, 2009-10-14, Jorgen Grahn wrote:   
   > On Wed, 2009-10-14, lancer6238@yahoo.com wrote:   
   >> Hi all,   
   >>   
   >> I'm looking for a way to prepend Ethernet headers to packets of the   
   >> form   
   >>   
   >> IP -> payload   
   >>   
   >> and have the resulting packets (Eth -> IP -> payload) be of libpcap   
   >> format.   
   >   
   > Why?  If you just want to make a valid pcap(3) file of it, consider   
   > the type DLT_RAW. That's a subformat where each packet is an IP packet   
   > (or IPv6 I suppose), not a link-layer frame.  Tools should generally   
   > accept that file format.   
   >   
   > But maybe you need the link layer headers.   
      
   And I mention it mostly because I have myself spent a lot of time   
   producing fake Ethernet headers because I thought a pcap file needed a   
   link-layer header in order to be valid.  It took me a year or two to   
   find DLT_RAW.   
      
   >> I've used text2pcap before, but I don't want to have to convert the IP   
   >> packets to text-form first.   
   >>   
   >> Is there anything in the libpcap library that could do this?   
   >   
   > libpcap doesn't do much with the frames themselves ... but you can   
   > earily use it to write a program which reads IP packets and writes   
   > Ethernet frames by prepending a hand-made Ethernet header.   
      
   /Jorgen   
      
   --   
     // Jorgen Grahn    O  o   .   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)