0

I'm a newbie with C language and I'm trying to write an Idle port monitor application for ethernet networks, the application measures broadcast traffic by protocol and generates a text file report, however the output it prints to the file is different from what is expected for example in line 174 of the code as shown below it prints out the expected value arp1_source 

arp1_source = source;
fprintf(stdout,"arp1->source is %s\n",arp1_source);

but when it prints out the content of the same variable in line 1365, it prints out a different mac address

fprintf(stdout ,"       %s          %d.%d.%d.%d      %d   %d\n",
  arp1_source,
  arp1_ip_source[0],
  arp1_ip_source[1],
  arp1_ip_source[2],
  arp1_ip_source[3],
  arp1_total,
  arp1);

I'm at a loss as to why this is happening,I have no idea of what I'm doing wrong please help,my code is below(although it quite long and I can send the full code if required ) thanks.

I have defined the variables but when I'm performing a live capture of packets, the value inside arp1_source printed out in the first line is different from what is written into the text file after the capture is complete that is in the first line it may print out

"arp1-source is 0e:32:64:89:20:5e"

and when it is to print out the mac address stored inside arp1_source to the text file as shown in the second code, it prints out a wrong mac address, seems like original mac address is overwritten by another one,I declared the char string to store the mac address with a const keyword.

alk
  • 69,737
  • 10
  • 105
  • 255
Dimeji
  • 1
  • 1
  • You have to give the *definition* of the stuff you try to print -_- – StoryTeller - Unslander Monica Feb 15 '13 at 11:32
  • 1
    A MAC address is made up of six hexadecimal bytes. You print four decimals, as if it was an IP address, not a MAC address. Which is it? – LSerni Feb 15 '13 at 11:32
  • What are the types of `arp1_ip_source[]`, `arp1_total` and `arp1`? Either they all must be `int` so `%d` works for them or you must change `%d` to whatever is appropriate (e.g. `%ld` for `long`). – Alexey Frunze Feb 15 '13 at 11:51
  • You should have not combined that piece of code into one line, it's now poorly readable and wrong. – Alexey Frunze Feb 15 '13 at 11:52
  • arp1_source appears to be a char *. If the variable you have arp1_source "aimed" at changed the output would also change. In this case source. All of this is a guess. – jim mcnamara Feb 15 '13 at 12:22
  • @jimmcnamara arp1_source is a char* I don't think the variable has changed, I can send you the code if you would like to see it, I would have pasted it here but it's very long – Dimeji Feb 15 '13 at 12:31
  • If the output of the sane pointer is different at point A and point B then the memory it points to has to have changed. Get into the debugger and set two breakpoints, each one before the print statements in question. Compare the pointer at each. – jim mcnamara Feb 15 '13 at 12:36

1 Answers1

0

seems like original mac address is overwritten by another one - yeah, that sounds like exactly what is happening.

The way this question is written currently, there's no way to answer it. You want to know why at line 174 you get your expected results, but at line 1365 there string has changed... Well to know that it would be preferable to see those 1191 lines of code. As you said, that's long, so here's some ideas:

  • Search for every place in your code where arp1_source is set or where another variable is set from it (specifically do you have any double pointers taking arp1_source's address?)

  • Do you ever pass the address of it to a function? That's a prime place for it to be changed

  • Get a debugger and step through your code. You know the value changes somewhere, you just need to figure out where.

  • Worst case, you can always binary search it. Somewhere around line 769 print the value of arp1_source, is it what you expect? if yes: print the value around 1066; if no: print the value around line 471, keep going until you hone in on exactly where the value is being changed

Mike
  • 47,263
  • 29
  • 113
  • 177
  • Probably not an answer, but way to long for a comment, and hopefully it will lead you there. – Mike Feb 15 '13 at 12:58