[Snort-devel] How can i extract the destination ip address from a packet??

Rob McMillen rvmcmil at ...1029...
Thu Apr 24 18:08:05 EDT 2003


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 24 Apr 2003, abhishek nigam wrote:

> Hi,
> I was trying to use p->iph->ip_dst to get the destination ip address of a packet but it gives me the same ip address as the source.
> Regards,
> Abhishek

How are you viewing the ip address?  Are you using something like this?

printf("src ip: %s, dst ip: %s\n", inet_ntoa(p->iph->ip_src),
       (inet_ntoa(p->iph->ip_dst));

If so, you will get the same address for the src and dst.  This is because 
inet_ntoa only uses one buffer.  Break it up into two statements and you 
will see the different ips.

Rob

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Made with pgp4pine 1.76

iQA/AwUBPqiJ4/nAyY+9KLjdEQIdKwCeIQY2Fvcg87HNDO8qoxYt919unMwAoI4K
IMNZ9Rgbw2FqJTz+MNUMzk2C
=Linv
-----END PGP SIGNATURE-----






More information about the Snort-devel mailing list