i'm trying to capture packets between my computer and internet, then i copy codes from examples. now i get two questions about libpcap.
i wrote these:

pcap_lookupdev(...);
pcap_lookupnet(...);
pcap_open_live(...);
pcap_loop(...);

and in my callbak function

u_int16_t handle_ethernet(u_char *args, const struct pcap_pkthdr *pkthdr, const u_char *packet)
{
struct ether_header *eptr;
eptr=(struct ether_header*)packet;
if(ntohs(eptr->ether_type)==ETHERTYPE_IP)
{
printf("ip\n");
}
else if(ntohs(eptr->ether_type)==ETHERTYPE_ARP)
{
printf("arp\n");
}
elseif(ntohs(eptr->ether_type)==ETHERTYPE_REVARP)
{
printf("revarp\n");
}
else
printf("unknown\n");
...
}

1. when i connect to internet via ADSL modem and "ping google.com", the programm always prints "unknown", shouldn't it be "ip"? if not, what is it? and when i ping the ADSL modem like this--ping 192.168.1.1, it prints "ip".

2. how can i know what the destinaion ip and source ip is? in brief, i want to get this "from 202.96.128.68 to 66.11.22.33" while i "ping google.com", can i do that with libpcap?


thanks.

no one helps me?

DSL is PPP, not broadcast. that means all those ethernet tests you are doing are worthless as you are not on an ethernet. that is unless you are behind a router on a LAN?