views:

291

answers:

3

Is it possible to have libpcap remove a packet instead of just sniff it as it passes through? I'm wanting to intercept each packet and encapsulate it into a new packet along with measurement data, but both packets (mine and the original) both reach the destination.

Many thanks

+1  A: 

The only way you could do this is by being the only physical path between the sender and receiver and turning off packet forwarding on the interceptor.

If you're capturing wireless traffic, there's nothing you can do. No software library can remove radio waves from the ambient air.

Ben S
+1  A: 

It's not possible. You need to write a driver (for your operating system) to make the networking stack filter out packets.

Martin v. Löwis
There are many linux kernel options to change the behavior of the network stack. For example, `echo 0 > /proc/sys/net/ipv4/ip_forward` turns off forwarding of packets that aren't addressed to this host.
Ben S
@Ben: that's correct. However, I doubt that you can use such a configuration to implement what he wants.
Martin v. Löwis
A: 

No, libpcap cannot "remove a packet".

It's not quite clear what you want to achieve, but it looks like you want to receive data, add some additional information to it, and republish it. If you are working with a datagram protocol such as UDP, then you might be able to simply resend your augmented data to a different UDP port.

bromfiets