Subject: Re: pcap and ICMP messages
To: Ignatios Souvatzis <>
From: =?utf-8?q?J=C3=B6rn_Seger?= <>
List: tech-net
Date: 09/15/2004 11:34:01
Am Mittwoch, 15. September 2004 11:20 schrieben Sie:
> On Wed, Sep 15, 2004 at 10:14:08AM +0200, J=C3=B6rn Seger wrote:
> > Hi all,
> >
> > I' m testing a communication protocol, which is based on ip. The
> > implementation is done with pcap. When I send arround packets, I allways
> > get some ICMP "protocol unreachable" back, what is completely correct
> > from the kernels point of view. But for me it's not really nice ...
> >
> > Any ideas/hacks to stop the kernel from sending these messages?
> open a raw IP socket for said protocol instead of using pcap?

I used something like that under linux, but on a BSD system I don't find a =
to get a packet directly from the data link layer without pcap (with the=20
IP-Header included).
A version of "socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))" would not wor=
under BSD.=20

> hack:
> setup ipfilter to block that ICMP error? (I don't know if it's fine-grain=
> enough for this...)

sound good, I will investigate that!

Thanks - J=C3=B6rn