Subject: mbuf and network question...
To: None <>
From: Andrew Brown <>
List: tech-net
Date: 08/18/2000 15:25:02
when examining an arp packet, and accounting for proxy arp, there are
two different ethernet addresses i'd like to be able to examine.  or

the first is, of course, ar_sha, which is the actual hardware address
to which subsequent ip datagrams will be sent.  usually this is

the other is the source address in the ethernet header itself.  in the
case of faulty proxy arp, this is the machine which is actually doing
the damage to the network, but as far as i can tell, nothing in the
arp layer actually logs this address anywhere, leaving the actual
culprit a mystery.

it strikes me, though, that the ethernet layer strips off the ethernet
header before passing it up, so this piece of information is lost.  or
is it?

|-----< "CODE WARRIOR" >-----|             * "ah!  i see you have the internet (Andrew Brown)                that goes *ping*!"       * "information is power -- share the wealth."