Guy Harris

And what is the tool you're using for "scanning"? In Nmap issue #nmap/nmap#2381, it says nmap should "verify that the pcap_datalink() type supports ARP before using ARP scan for host...

> > Is this the same issue as #578? If a Wireguard tunnel reports an NdisMedium type that libpcap's pcap-npf maps to a DLT_ type that the libpcap pcap compiler...

It would be best if nmap would avoid doing *anything* involving MAC addresses - including assuming that a network *has* MAC addresses and that "ether host"/"ether src"/"ether dst" will work...

> So If I understand correctly the current situation is to wait for/write code that would disable any ARP related actions in nmap. Or whatever it is that's causing nmap...

Doesn't seem to happen on 1.10.

Duplicate of #1009

This should be fixed by 6493919a4c7cf15d3d4f9878b2f290dd36efafc0.

> Will this commit be backported to the git branch libpcap-1.10? Yes, I backported the configuration fixes from the main branch to the 1.10 branch.

If 1.10 doesn't fix the problem, please speak up, otherwise we'll close this.

And there may be other network types that, for example, report an NdisMedium type of `NdisMediumIP`, meaning "no link-layer header, just packets that begin with an IP header"; that may...