PCAP Destination and Source are the same

Question

I'm having a bit trouble with libpcap. I'm using pcap_loop() with this callback:

void pcap_callback(u_char *useless, const struct pcap_pkthdr *pcap_header, const u_char *packet) {  
    struct ether_header *head = (struct ether_header *)packet;
    struct ip *ip = (struct ip *)(packet + sizeof(struct ether_header));

    u_short eth_type = ntohs(head->ether_type);
    const char *s_ipad = inet_ntoa(ip->ip_src);
    const char *d_ipad = inet_ntoa(ip->ip_dst);
    const char *s_host = ether_ntoa((struct ether_addr *)head->ether_shost);
    const char *d_host = ether_ntoa((struct ether_addr *)head->ether_dhost);

    if (eth_type == ETHERTYPE_IP || eth_type == ETHERTYPE_IPV6) {
        NSLog(@"\nPACKET\ns IP  : %s\ns MAC: %s\n\nd IP  : %s\nd MAC: %s\n\n", s_ipad, s_host, d_ipad, d_host);
    }
}

On the console I get packets whose destination and source are exactly the same. So the IP and MAC addresses don't differ. Using filters I could figure out that the packets all have the destinations addresses.

This is the code I'm using to start pcap:

void sniff() {
    pcap_t *handle;
    char *device;
    char errbuf[PCAP_ERRBUF_SIZE];

    char *net;
    char *mask;
    bpf_u_int32 netp;
    bpf_u_int32 maskp;
    struct in_addr addr;

    device = "en1";

    pcap_lookupnet(device, &netp, &maskp, errbuff);

    addr.s_addr = netp;
    net = inet_ntoa(addr);
    NSLog(@"ROUTER: %s", net);

    addr.s_addr = maskp;
    mask = inet_ntoa(addr);
    NSLog(@"SNMASK: %s", mask);

    handle = pcap_open_live(device, BUFSIZ, 0, 10, errbuf);

    struct bpf_program filterProgram;
    pcap_compile(handle, &filterProgram, "src 10.0.10.40 or dst 10.0.10.40", 1, maskp);
    pcap_setfilter(handle, &filterProgram);

    pcap_loop(handle, 100, pcap_callback, NULL);
    pcap_close(handle);
}

Answer 1

From 'man inet_ntoa': The inet_ntoa() function converts the Internet host address in, given in network byte order, to a string in IPv4 dotted-decimal notation. The string is returned in a statically allocated buffer, which subsequent calls will overwrite.

So you must copy s_ipad and s_host before calling inet_ntoa and ether_ntoa again. Something like this:

const char *aux = inet_ntoa(ip->ip_src);
const char *s_ipad = strcpy(new char[strlen(aux)+1], aux);
aux = inet_ntoa(ip->ip_dst);
const char *d_ipad = strcpy(new char[strlen(aux)+1], aux);
aux = ether_ntoa((struct ether_addr *)head->ether_shost);
const char *s_host = strcpy(new char[strlen(aux)+1], aux);
aux = ether_ntoa((struct ether_addr *)head->ether_dhost);
const char *d_host = strcpy(new char[strlen(aux)+1], aux);
//do whatever...    
delete[] s_ipad; delete[] d_ipad;delete[] s_host; delete[] d_host;