4

I am trying to convert hping3 to hping6. hping3 uses Pcap library to receive IPv4 packets. But I need to receive IPv6 packets.

Nasreddine
  • 36,610
  • 17
  • 75
  • 94
Adi
  • 1,589
  • 3
  • 19
  • 27
  • You definitely can use libpcap to capture ipv6 packets (as wireshark and the gang definitely capture them). Having never used libpcap directly I can't offer you any more help, but it is definitely possible. – Mark Drago Jun 06 '11 at 19:14

2 Answers2

6

That is possible. libpcap is able to catch anything on the wire.

Jille Timmermans
  • 61
  • 1
  • +1, this includes things which aren't IPv4 (like ARP, which sits directly on top of ethernet frames). Where in IPv4 PCAP code you'd use ETHERTYPE_IP, you simply use ETHERTYPE_IPV6 instead, with appropriate header structs too. – Flexo Jun 07 '11 at 22:08
3

Example using ETHERTYPE_IPV6:

static u_int16_t ether_packet(u_char *args, const struct pcap_pkthdr *pkthdr, co
nst u_char *p) {
  struct ether_header *eptr = (struct ether_header*)p;

  assert(pkthdr->caplen <= pkthdr->len);

  assert(pkthdr->caplen >= sizeof(struct ether_header));

  return eptr->ether_type;
}


// This is the callback. assumes ethernet frame.
static void pcap_callback(u_char *args,const struct pcap_pkthdr* pkthdr,const u_
char* p)
{
  const u_int16_t type = ether_packet(args, pkthdr, p);
  switch (ntohs(type)) {
  case ETHERTYPE_IP:
    // handle IPv4 
    break;
  case ETHERTYPE_IPV6:
    // handle v6
    break;
  }
}
Flexo
  • 87,323
  • 22
  • 191
  • 272