0

I'm using libpcap on Linux to capture network traffic from a wireless adapter (2.4 GHz). The pcap_setdirection seems to allow you to setup the capture device so that it ignores traffic originating from the device, but I get an error when I try to set it to return incoming traffic only.

My libpcap version appears to be 1.9.1, so directional capture should be supported. I know wired Ethernet has transmit and receive lines, which could be used to distinguish outgoing data from incoming data, but I'm not sure if WiFi adapters have a way to determine which device the traffic came from (self v. others).

Are there any special hardware or kernel requirements for restricting the traffic direction with libpcap (no-WiFi, kernel settings, adapter support, etc.)?

2
  • 1
    Note that libpcap captures packets from the kernel, before they reach the hardware – so it absolutely does not care whether the physical link has separate wires or not. (Gigabit Ethernet doesn't.) Mar 12, 2020 at 14:18
  • @user1686 I had no idea the wires in Gigabit Ethernet were bidirectional, that's pretty interesting.
    – user
    Mar 12, 2020 at 14:33

1 Answer 1

1

According to this email chain, it should work with any device supporting monitor mode on Linux and BSD as long as the library is recent enough.

I was getting an error because unlike every other configuration call, pcap_setdirection only works after the capture handle has been activated.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .