Etherreal | Off Topic | unofficial empeg BBS

Quick Links: Empeg FAQ | RioCar.Org | Hijack | BigDisk Builder | jEmplode | emphatic
Repairs: Repairs

You are not logged in. [Log In] empegbbs.com » Forums » General Discussion » Off Topic » Etherreal

Topic Options

#279208 - 07/04/2006 19:10 Etherreal
sn00p addict Registered: 24/07/2002 Posts: 618 Loc: South London	I spent all today interfacing to a ethernet chip and looking at packets.... Why the hell doesn't etherreal allow you to load a single packet as a binary dump?! The text2pcap software is complete and utter junk that wouldn't take any input (binary->text using od.exe), even as specified in it's manpage. I ended up having to write a small utility to dump the binary output as text that it liked, but I find it ever so amusing that I have to drop to a command line to run a batch file to get the packet into a format that it'll understand. Most frustrating day ever. I still don't get how ARP doesn't end up with it's knickers in a twist when DHCP gets involved. (release address and allocate a new one). I need a beer.
Top

#279209 - 07/04/2006 19:52 Re: Etherreal [Re: sn00p]
matthew_k pooh-bah Registered: 12/02/2002 Posts: 2298 Loc: Berkeley, California	Quote: I still don't get how ARP doesn't end up with it's knickers in a twist when DHCP gets involved. (release address and allocate a new one). If things don't work out it gives up and tries arping the address again. If two hosts have the same IP, you're screwed of course, but that's your fault. You can usualy assume when you see a cache that the designers have figured out how to either keep the cache in sync with the actual data, or know how to deal with bad data. Is there a specific question dealing with ARP? I've never heard of anyone having an actual problem with it. Matthew
Top

#279210 - 07/04/2006 20:05 Re: Etherreal [Re: matthew_k]
sn00p addict Registered: 24/07/2002 Posts: 618 Loc: South London	Quote: Is there a specific question dealing with ARP? I've never heard of anyone having an actual problem with it. Not really, only that I'm implementing a "as minimal and fast" as possible UDP implementation on an embedded system, but this obviously requires the use of ARP (ok, technically it doesn't it could all be hard wired, but I'd like to use dynamic ip in the future). Having read up on as much as possible I was just curious as to how bad ARP data is dealt with. My other solution is to simply just use my own data format for the packets and forget UDP all together (the network in this case is "private" and contains only the embedded units), but it would be handy to allow a PC onto this network for configuration and such like. I know that linux is capable of reading/writing raw packets "out of the box", but using a standard IP protocol seems a better way to go - seeing as UDP isn't that difficult to implement.
Top

#279211 - 10/04/2006 05:21 Re: Etherreal [Re: sn00p]
sn00p addict Registered: 24/07/2002 Posts: 618 Loc: South London	Ok, despite the fact that I think etherreal should be able to open a single binary packet, it proved very useful I got ARP, ICMP (echo) & UDP all working nicely and with the tinyist amount of code, which is good enough for our application (abliet with my "stack" running on the PC through pcap with the card in promiscous mode) Today will be fun
Top

#279212 - 10/04/2006 13:48 Re: Etherreal [Re: sn00p]
wfaulk carpal tunnel Registered: 25/12/2000 Posts: 16706 Loc: Raleigh, NC US	Quote: I still don't get how ARP doesn't end up with it's knickers in a twist when DHCP gets involved. (release address and allocate a new one). When a new machine comes online and when an already-online machine gains a new IP address, it is supposed to generate a gratuitous ARP request. (That is, it asks if anyone knows what MAC address its own IP address is at, then it answers it itself.) That gratuituous ARP should put the new information in the ARP table of every machine listening on the local network. You can often see the sort of problem you're expecting when you hot swap two machines with the same IP address. The new machine may not realize that it ought to send out a gratuitous ARP (computers don't tend to do it when their network connection goes offline for a second, for example), so all the other computers, often including switches, still have the old information cached. _________________________ Bitt Faulk
Top

#279213 - 10/04/2006 17:49 Re: Etherreal [Re: wfaulk]
sn00p addict Registered: 24/07/2002 Posts: 618 Loc: South London	Ooh...thanks bitt. Actually I saw some of the gratuituous ARP packets today in ethereal and wondered what they were, but I've spent so much time reading RFC's my mind is going round the bend! Actually, so much so that I couldn't figure out why I wasn't seeing a response to the DHCP discover packet I was sending, spent most of the afternoon trying to find out why..... ...only to finally remember that the network in my office is plugged into a switch not a hub, so I wouldn't see the response to the discover packet on ethereal on my PC! Obviously when I put a breakpoint on my UDP code the packet was coming back in....d'oh. Taking in my little 4 port hub tomorrow so I can at least use ethereal to verify my packets and see the traffic flow! Edited by sn00p (10/04/2006 17:51)
Top

#279214 - 10/04/2006 17:57 Re: Etherreal [Re: sn00p]
wfaulk carpal tunnel Registered: 25/12/2000 Posts: 16706 Loc: Raleigh, NC US	No problem. That knowledge was hard-gained, let me tell you. _________________________ Bitt Faulk
Top

#279215 - 11/04/2006 05:17 Re: Etherreal [Re: sn00p]
Roger carpal tunnel Registered: 18/01/2000 Posts: 5682 Loc: London, UK	Quote: Taking in my little 4 port hub tomorrow so I can at least use ethereal to verify my packets and see the traffic flow! Yep, I'll be doing the same today for the (PXE) DHCP server I'm currently writing, too _________________________ -- roger
Top

#279216 - 11/04/2006 09:12 Re: Etherreal [Re: Roger]
sn00p addict Registered: 24/07/2002 Posts: 618 Loc: South London	Quote: Quote: Taking in my little 4 port hub tomorrow so I can at least use ethereal to verify my packets and see the traffic flow! Yep, I'll be doing the same today for the (PXE) DHCP server I'm currently writing, too Cool. I got my DHCP client working this morning ARP+UDP+DHCP+ICMP (echo) in 7K of ("C") ARM code, but some of the DHCP code is duplicated (DISCOVER & REQUEST packets), so I should be able to save more code space when I clean everything up!
Top

View All Topics