01-13-2009
Memory sniffing in linux
I am trying to create an application that will be able to sniff memory of other applications.
I am not completely new to systems programming but I am not sure how to go about this task. I understand that accomplishing this mainly require these steps.
1: Get a list of processes
2: Find the process you want to sniff.
3: Get a list of page tables assigned to that process
4: Get R / R/W access to these page tables.
5: Sniff away.
I can do 1&2 just fine, but I have no clue how to accomplish the rest.
I understand that 3 will have to do something with the process control block, and 4 will probably have to do with some system calls with high privileges.
Any advice on doing this would be appreciated, and if there are any books on this subject in particular, that would be great as well.
9 More Discussions You Might Find Interesting
1. IP Networking
Hi All,
On a solaris box A port B
in which port B is established and receiving data.
My question is how do i listen on that established port ,
how can i get the data received at box A: port B through my application
I had searched the forum for the same, but i am unable to retrieve the... (5 Replies)
Discussion started by: matrixmadhan
5 Replies
2. Programming
Hi,
Does any one know what tool to use to visualize how is memory layed out for C on linux systems. I mean how much stack portion is used in functional call.
Where exactly does the argument to function sit in memory ?
I have written small program pasted below. But I am not able to infer... (3 Replies)
Discussion started by: parasa
3 Replies
3. UNIX for Advanced & Expert Users
Hi,
I having problem with my linux machine
it have 6Gb physical memory and somehow it always almost coming to the bottom neck and than it start writing to the swap memory
you can see that there is more than 4G in cahce, is there any way to clean the cache or to limit it to 2Gb?
host1... (6 Replies)
Discussion started by: Igal Malka
6 Replies
4. Programming
Can someone please help me figure out how to use pcap.h to sniff packets between only 2 computers whose mac addresses are know?
Thanks (0 Replies)
Discussion started by: papabearcares
0 Replies
5. Shell Programming and Scripting
Can someone please help me figure out how to use pcap.h to sniff packets between only 2 computers whose mac addresses are know?
Thanks (0 Replies)
Discussion started by: papabearcares
0 Replies
6. Linux
Hi All,
We are using the linux servers and need to track the memory utilization of the box. Could anyone advice how the same can be achived.
:) (1 Reply)
Discussion started by: haitorajesh
1 Replies
7. What is on Your Mind?
Are we safe using the everyday wired keyboard? Although this concept is old, I had never seen an actual implementation on the matter until a few days ago. (Four ways of sniffing the electromagnetic emanations of wired keyboards currently on the market in up to 20 meters.)
Check the videos at:... (2 Replies)
Discussion started by: redoubtable
2 Replies
8. Red Hat
Hello, I am using Linux os.
$ df -k /dev/shm
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 2023256 1065000 958256 53% /dev/shm
$
Based on my google this, it is shared memory. What is this shared memory and where exactly it is used? Can you... (5 Replies)
Discussion started by: govindts
5 Replies
9. Linux
Hi All,
We are running a python application on an RHEL 7 VM machine hosted in Azure. Machine has 8GB of memory & 2GB of swap space configured as swap file. Below the output of free command from the server.
#-> free -h
total used free shared buff/cache ... (12 Replies)
Discussion started by: veeresh_15
12 Replies
LEARN ABOUT LINUX
pppoe-sniff
PPPOE-SNIFF(8) System Manager's Manual PPPOE-SNIFF(8)
NAME
pppoe-sniff - examine network for non-standard PPPoE frames
SYNOPSIS
pppoe-sniff [options]
DESCRIPTION
pppoe-sniff listens for likely-looking PPPoE PADR and session frames and deduces extra options required for pppoe(8) to work.
Some DSL providers seem to use non-standard frame types for PPPoE frames, and/or require a certain value in the Service-Name field. It is
often easier to sniff those values from a machine which can successfully connect rather than try to pry them out of the DSL provider.
To use pppoe-sniff, you need two computers, a DSL modem and an Ethernet hub (not an Ethernet switch.)
If the DSL modem normally connects directly to your computer's Ethernet card, connect it to the "uplink" port on the Ethernet hub. Plug
two computers into normal ports on the hub. On one computer, run whatever software the DSL provider gave you on whatever operating system
the DSL provider supports. On the other computer, run Linux and log in as root.
On the Linux machine, put the Ethernet interface into promiscuous mode and start pppoe-sniff. If the ethernet interface is eth0, for exam-
ple, type these commands:
ifconfig eth0 promisc
pppoe-sniff -I eth0
On the other machine, start your DSL connection as usual. After a short time, pppoe-sniff should print recommendations for the value of
PPPOE_EXTRA. Set this value in /etc/ppp/pppoe.conf. If pppoe-sniff indicates that something special is required in PPPOE_EXTRA, please e-
mail this to pppoe@roaringpenguin.com along with the name of your ISP and the manufacturer and model number of your DSL modem. This infor-
mation will be collated and provided on the PPPoE web page for users who do not have two computers.
After pppoe-sniff finishes (or you stop it if it seems hung), remember to turn off promiscuous mode:
ifconfig eth0 -promisc
OPTIONS
-I interface
The -I option specifies the Ethernet interface to use. Under Linux, it is typically eth0 or eth1. The interface should be "up" and
in promiscuous mode before you start pppoe-sniff.
-V The -V option causes pppoe-sniff to print its version number and exit.
BUGS
pppoe-sniff only works on Linux.
AUTHORS
pppoe-sniff was written by David F. Skoll <dfs@roaringpenguin.com>.
The pppoe home page is http://www.roaringpenguin.com/pppoe/.
SEE ALSO
pppd(8), pppoe(8), pppoe-sniff(8), pppoe-relay(8), /usr/share/doc/pppoe/README.Debian.gz
4th Berkeley Distribution 3 July 2000 PPPOE-SNIFF(8)