Subject: Re: pcap and ICMP messages
To: mouss <>
From: =?utf-8?q?J=C3=B6rn_Seger?= <>
List: tech-net
Date: 09/16/2004 07:44:16
you are right - these three seam to be my options ... I'm working on to man=
sites, I believe :-/ - sorry for my confusion

I think, I will implement the raw socket suggestion alternatively.

Thank you all - J=C3=B6rn

PS: If this stuff really get's into a stage of usability, I will let you kn=

Am Donnerstag, 16. September 2004 01:33 schrieben Sie:
> It's not easy to see where you're heading...
> however, unless I'm missing something, you only have 3 ways:
> - use raw sockets as suggested by Ignatios. of course, you'll need as
> many sockets as protocols, but if you only need to handle a finite
> number of protocols, it's just a matter of programming.
> - use pcap as you did, and get rid of the error messages by:
>     * ignoring them:)
>     * droping the packets by ipf as ignatios said
> - modify the ip stack. this is only worth the pain if you can "justify"
> it, but it's not beyond reach.