接收不同MAC地址的数据包
是否有可能以混杂模式捕获一些数据包（例如使用 winpcap），然后强制操作系统（应用程序）接收它们，因为它们是为我们的 MAC 发送的？
我的观察如下。我们可以：
- 使用捕获所有网络流量 混杂模式（winpcap）
- 使用过滤/修改数据包 防火墙钩子/过滤器钩子
- 将数据包发送到具有更改的 MAC 的网络
我不确定防火墙钩子是否可以访问由于混杂模式而可用的所有数据包。不是在下层吗？如果不能，唯一的解决方案是捕获所需的数据包，然后使用更改后的 MAC 将它们重新发送到网络？
我是网络新手，所以请对我宽容一些：）
任何帮助都将不胜感激。 提前致谢。
is it possible to capture some packets in promiscuous mode (e.g. using winpcap) and than force OS (applications) to receive them as they were sent for our MAC?
My observation is following. We can:
- capture all network traffic using
promiscuous mode (winpcap) - filter/modify the packets using
firewall-hook/filter-hook - send packets to the network with altered MAC
I am not sure if firewall-hook can access all the packets which are available thanks to promiscious mode. Isn't it on the lower layer? If it can't, the only solution would be to capture desired packets and then resend them to the network with altered MAC?
I am networking novice so please be easy on me :)
Any help is appreciated.
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您已接近白帽/黑帽黑客。我知道我的公司积极监视混杂的 NIC，追捕所有者并杀死（解雇）他们。也许如果您问我们您想做什么，我们可以提供一些建议。
如果您尝试分析您的网络，有些软件和/或硬件解决方案可能会做得更好。如果您只是想观看网络中有趣的文本流，那么......也许您还在上大学。
You have your toes at the line of white hat/black hat hackers. I know that my company actively watches for promiscuous NICs, hunts down the owners and kills (fires) them. Maybe if you ask us what you're trying to do, we can offer some suggestions.
If you're trying to analyze your network, there is software and/or hardware solutions that will probably do a better job. If you're just trying to watch interesting text flow across your network, well ... maybe you're still in college.
首先，是的，如果您的接口在混杂模式下运行，那么您将收到“在线”的所有内容。这已经是一个困难，现在许多（如果不是全部）网络都是交换的，这意味着系统外部的硬件在数据包到达您的系统之前已经进行了一些过滤，因此您首先需要欺骗交换机将这些数据包传输到您的一端（可以通过发送虚拟 arp、配置交换机或恶意来完成;-)）。
那么，如果这些数据包在您的系统中收到，您打算如何处理它们？以太网帧将携带 ip 数据包，通常带有目标 ip 地址，而该地址已经不在您的主机上（如果是，则意味着您的网络上将有重复的 ip 地址，也会导致问题。
所以主要的问题是，你真正想做的是什么？
First, yes if your interface operates in promiscuous mode then you will receive everything 'on the wire'. Which is already one difficulty, nowadays many (if not all) networks are switched, which means a piece of hardware exterior to your system will already do some filtering before packets arrive at your system, so you'll first need to trick a switch into transmitting those packets to your end (can be done by sending out dummy arps, by configuring the switch, or by bad intent ;-) ).
Then if these packets receive at your system, what do you plan to do with them ? There ethernet frames will carry ip packets, typically with a destination ip address, which is already something which will not be on your host (and if it is, this implies that you will have duplicate ip addresses on your network, causing problems as well.
So the main question is, what do you really really really want to do ?
一旦收到数据包，它就已经通过协议栈了。我不认为 Windows 会给你访问 Winsock 中间的权限，而这需要以某种方式将其重新插入。
更重要的是，这是一个非常危险的想法。无论您想做什么，我可以向您保证有更好的方法来做到这一点。
Once you have recieved a packet, it has already been clean through the protocol stack. I don't think Windows gives you the access into the middle of Winsock that would be required to somehow stick it back in.
More importantly, this is a really dodgy think to be looking to do. Whatever it is you are looking to do, I can guarantee you there is some better way to do it.