I'm using libpcap on Linux to capture network traffic from a wireless adapter (2.4 GHz). The pcap_setdirection seems to allow you to setup the capture device so that it ignores traffic originating from the device, but I get an error when I try to set it to return incoming traffic only.

My libpcap version appears to be 1.9.1, so directional capture should be supported. I know wired Ethernet has transmit and receive lines, which could be used to distinguish outgoing data from incoming data, but I'm not sure if WiFi adapters have a way to determine which device the traffic came from (self v. others).

Are there any special hardware or kernel requirements for restricting the traffic direction with libpcap (no-WiFi, kernel settings, adapter support, etc.)?

  • 1
    Note that libpcap captures packets from the kernel, before they reach the hardware – so it absolutely does not care whether the physical link has separate wires or not. (Gigabit Ethernet doesn't.) – user1686 Mar 12 '20 at 14:18
  • @user1686 I had no idea the wires in Gigabit Ethernet were bidirectional, that's pretty interesting. – user Mar 12 '20 at 14:33

According to this email chain, it should work with any device supporting monitor mode on Linux and BSD as long as the library is recent enough.

I was getting an error because unlike every other configuration call, pcap_setdirection only works after the capture handle has been activated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.