[ee122] MNL sends out pACKets on MNL.listen_port+1 (watch out!)

Drew Lustro drewlustro at gmail.com
Mon Dec 10 20:18:01 PST 2007


I'm was having trouble finding out what ports to capture on for each  
side, half becauce im not sure and half because the results reported  
by packet_parser are unexpected.... however I figured it out and I  
think this is undocumented.

the MNL Daemon listens on say, port 12345 BUT when it sends anything  
out, it actually sends it out on 12346 (<MNL port> + 1)... which is  
something you must know when selecting udp ports to observe when  
running tcpdump.

This is probably confusing to everyone...

Drew


More information about the ee122 mailing list