title: Forwarding packets with pcap
body: <p>I try to forward sniffed packets to the real destination with <code>libpcap</code>. I'm using arp spoofing to redirect the traffic, and I can route it with TCP/IP routing enabled on Win7. Is it possible to do this using only libpcap (or maybe libnet)? I tried every way, with libnet I reconstructed the packets with a <code>RAW4</code> interface, tried with link layer too setting the source to my MAC, and the dest to broadcast address. </p>
  
  <p>I tried with this simple callback in the sniffer using <code>pcap</code>:</p>
  
  <pre><code>static void ForwardCallback(byte* args, const pcap_pkthdr *header, const byte* packet)
  {
      assert(args);
      ForwInput* input = (ForwInput*)args;
      PcapHandle* handle = input-&gt;handle;
      assert(handle);
  
      EthernetHeader* ethernet_header = (EthernetHeader*)packet;
      //modifying the spoofed addresses
      memcpy(ethernet_header-&gt;src_addr.data, input-&gt;my_mac.data, ETHER_ADDR_LEN); //my mac address
      memcpy(ethernet_header-&gt;dest_addr.data, ether_broadcast, ETHER_ADDR_LEN); //0xff, 0xff...
  
      IPv4Header* ipv4_header = (IPv4Header*)(packet + LIBNET_ETH_H);
  
      if (pcap_sendpacket(handle, packet, header-&gt;len) == -1)
      {
          DumpError(pcap_geterr(handle)); //no errors
      };
  };
  </code></pre>
  
  <p>The connection between the default gateway and a test laptop is spoofed, and on my pc the forwarding is disabled (<em>Routing and Remote Access</em>). I opened the handle with </p>
  
  <pre><code>handle = pcap_open(device.c_str(),
              0xffff,
              PCAP_OPENFLAG_PROMISCUOUS,
              100,
              nullptr,
              &amp;error[0]
              );
  </code></pre>
  
  <p>No filtering applied, the ARP cache is correct in my pc. I can see all broadcast packets in the victim pc, the IP header addresses are valid too. I'm not sure if this is true, but modifying only the link layer (ethernet header) is enough for this case because only they are spoofed.</p>
  
  <p>Sometimes the page loading terminates with DNS service unavaible or cannot find the host, but sometimes its just loading infinitely.</p>