Sponsored Content
Special Forums IP Networking how to hack linux driver to delay incoming packets Post 302503009 by Corona688 on Wednesday 9th of March 2011 12:33:09 PM
Old 03-09-2011
You can easily delay packets leaving the system using traffic control, but entering? That's a ton harder and much less stable: It has to store everything before it lets it enter, you get the potential for states where the kernel can't store as fast as it's receiving and has no way to tell the other end to slow down. In-kernel memory is also limited.

I'm not sure you need driver hacking to do it anyway. Doing it in userspace avoids most of the above problems. I'd try this:
  • Create a tun/tap interface (see Documentation/networking/tuntap.txt in the linux kernel)
  • Configure your ethernet device for 0.0.0.0, remove it from the routing table, and just read/write raw packets with a userspace program.
  • Write raw packets from the ethernet adaptor to the tun/tap device. Write raw packets from the tun/tap device to the ethernet adaptor. Your program can store them for how long you want inbetween.
  • Use your tun/tap device for normal traffic. Add it to the routing table, etc. so normal programs use it.
This User Gave Thanks to Corona688 For This Post:
 

9 More Discussions You Might Find Interesting

1. Red Hat

How to check the outbound packets in Linux

I have a linux redhat box , our security department in my company informed me that my server's IP sends So many traffic in my network , This box I am using it as FTP server to store the other servers logs . My question briefly is how to check my outbound packets which are going from my PC to the... (1 Reply)
Discussion started by: DarkSoul
1 Replies

2. Cybersecurity

~ IPTables : Limit Incoming UDP Packets With a Certain Length ~

Hello, I am currently trying to limit incoming UDP length 20 packets on a per IP basis to 5 a second using IPTables on a Linux machine (CentOS 5.2). Basically, if an IP is sending more than 5 length 20 UDP packet a second to the local machine, I would like the machine to drop the excess... (1 Reply)
Discussion started by: tomboy123
1 Replies

3. UNIX for Dummies Questions & Answers

Linux box drops the incoming packets

Hi all, I am new to Linux kernel. we have a c file that counts the no. of sends and received packets in each interface, and indicate the user about the error/drop ration of incoming and outgoing packets. in our Linux box , the incoming packets are dropped at random interval. we have our... (1 Reply)
Discussion started by: kannandv
1 Replies

4. IP Networking

how to delay the outgoing packets ??

hello, i am searching a way to delay the incoming packets before it goes out of the system may i know how can i approach to this problem? (3 Replies)
Discussion started by: sameer kulkarni
3 Replies

5. Linux

how to allow incoming UDP packets with iptables

I am looking for an iptables command to allow incoming UDP packets for my Linux server also is there a command I can use to set the default action for outgoing packets to accept? Thank you (1 Reply)
Discussion started by: crimputt
1 Replies

6. Cybersecurity

How can someone hack into a Linux server ?

Hi! I have a debian linux VPS and i am wondering how would someone be able to hack into it , in what ways ? I've asked a more knowledgeable friend and he said the only way someone would be able to get into my VPS is via FTP or SSH, are there some other ways someone can enter my machine ? I... (18 Replies)
Discussion started by: ParanoiaUser
18 Replies

7. IP Networking

How to route all incoming packets from one virtual interface?

Hello, I'm trying to route all packets arriving at a particular interface by entering the same interface the virtual interface eth1: 2 and now everything is routed by default gw configured on eth1. eth1 Link encap:Ethernet HWaddr 0a:0e:64:18:52:72 inet addr:192.168.10.15 eth1:2 ... (1 Reply)
Discussion started by: faka
1 Replies

8. Red Hat

Hack a centos Linux box

HI, I have a Centos linux box and there is interface connect to internet. I stop the iptables in this box . After a few day , I find the linux box have been hacked and install some perl script into the box . Could anyone tell me how the hacker can login into the centos box without knowing... (1 Reply)
Discussion started by: chuikingman
1 Replies

9. IP Networking

How to route packets back to incoming interface?

Hi folks, I have a debian server running an Apache daemon on the eth0 interface. Now from time to time the server has to open an openvpn connection (tun0) to other networks to get some data from there. During this period the Apache is no longer reachable under it's IP address on eth0 because all... (6 Replies)
Discussion started by: flyingwalrus
6 Replies
GVPE.OSDEP(5)						   GNU Virtual Private Ethernet 					     GVPE.OSDEP(5)

NAME
gvpe.osdep - os dependent information DESCRIPTION
This file tries to capture OS-dependent configuration or build issues, quirks and platform limitations, as known. TUN vs. TAP interface Most operating systems nowadays support something called a tunnel-device, which makes it possible to divert IPv4 (and often other protocols, too) into a user space daemon like gvpe. This is being referred to as a TUN-device. This is fine for point-to-point tunnels, but for a virtual ethernet, an additional ethernet header is needed. This functionality (called a TAP device here) is only provided by a subset of the configurations. On platforms only supporting a TUN-device, gvpe will invoke it's magical ethernet emulation package, which currently only handles ARP requests for the IPv4 protocol (but more could be added, bu the tincd network drivers might need to be modified for this to work). This means that on those platforms, only IPv4 will be supported. Also, since there is no way (currently) to tell gvpe which IP subnets are found on a specific host, you will either need to hardwire the MAC address for TUN-style hosts on all networks (and avoid ARP altogether, which is possible), or you need to send a packet from these hosts into the vpn network to tell gvpe the local interface address. Interface Initialisation Unless otherwise notes, the network interface will be initialized with the expected MAC address and correct MTU value. With most interface drivers, this is done by running /sbin/ifconfig, so make sure that this command exists. Interface Types native/linux TAP-device; already part of the kernel (only 2.4+ supported, but see tincd/linux). This is the configuration tested best, as gvpe is being developed on this platform. ifname should be set to the name of the network device. To hardwire ARP addresses, use iproute2 (arp can do it, too): MAC=fe:fd:80:00:00:$(printf "%02x" $NODEID) ip neighbour add 10.11.12.13 lladdr $MAC nud permanent dev $IFNAME tincd/linux TAP-device; already part of the kernel (2.2 only). See native/linux for more info. ifname should be set to the path of a tap device, e.g. /dev/tap0. The interface will be named accordingly. native/cygwin TAP-device; The TAP device to be used must either be the CIPE driver (http://cipe-win32.sourceforge.net/), or (highly recommended) the newer TAP-Win32 driver bundled with openvpn (http://openvpn.sf.net/). Just download and run the openvpn installer. The only option you need to select is the TAP driver. ifname should be set to the name of the device, found in the registry at (no kidding :): HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}<adapterid>ConnectionName The MAC address is dynamically being patched into packets and ARP-requests, so only IPv4 works with ARP on this platform. tincd/bsd TAP-device, maybe; migth work for many bsd variants. This driver is a newer version of the tincd/*bsd drivers. It might provide a TAP device, or might not work at all. You might try this interface type first, and, if it doesn't work, try one of the OS-specific drivers. tincd/freebsd TAP-device; part of the kernel (since 4.x, maybe earlier). ifname should be set to the path of a tap device, e.g. /dev/tap0. The interface will be named accordingly. These commands might be helpful examples: ifconfig $IFNAME 10.0.0.$NODEID route add -net 10.0.0.0 -netmask 255.255.255.0 -interface $IFNAME 10.0.0.$NODEID tincd/netbsd TUN-device; The interface is a point-to-point device. To initialize it, you currently need to configure it as a point-to-point device, giving it an address on your vpn (the exact address doesn't matter), like this: ifconfig $IFNAME mtu $MTU up ifconfig $IFNAME 10.11.12.13 10.55.66.77 route add -net 10.0.0.0 10.55.66.77 255.0.0.0 ping -c1 10.55.66.77 # ping once to tell gvpe your gw ip The ping is required to tell the ARP emulator inside GVPE the local IP address. ifname should be set to the path of a tun device, e.g. /dev/tun0. The interface will be named accordingly. tincd/openbsd TUN-device; already part of the kernel. See tincd/netbsd for more information. native/darwin TAP-device; The necessary kernel extension can be found here: http://www-user.rhrk.uni-kl.de/~nissler/tuntap/ There are two drivers, the one to use is the "tap" driver. It driver must be loaded before use, read the docs on how to install it as a startup item. ifname should be set to the path of a tap device, e.g. /dev/tap0. The interface will be named accordingly. These commands might be helpful examples: ifconfig $IFNAME 10.0.0.$NODEID route add -net 10.0.0.0 -interface $IFNAME 255.255.255.0 tincd/darwin TUN-device; See tincd/netbsd for more information. native/darwin is preferable. The necessary kernel extension can be found here: http://chrisp.de/en/projects/tunnel.html ifname should be set to the path of a tun device, e.g. /dev/tun0. The interface will be named accordingly. The driver must be loaded before use: kmodload tunnel tincd/solaris TUN-device; already part of the kernel(?), or available here: http://vtun.sourceforge.net/tun/ Some precompiled tun drivers might be available here: http://www.monkey.org/~dugsong/fragroute/ The interface MAC and MTU are NOT set up for you. Please try it out and send me an ifconfig command invocation that does that. See tincd/netbsd for more information. Completely untested so far. tincd/mingw TAP-device; see native/cygwin for more information. The setup is likely to be similar to native/cygwin. Completely untested so far. tincd/raw_socket TAP-device; purpose unknown and untested, probably binds itself on an existing ethernet device (given by ifname). It must be down prior to running the command, and GVPE will try to set it's MAC address and MTU to the "correct" values. Completely untested so far. tincd/uml_socket TAP-device; purpose unknown and untested, probably creates a UNIX datagram socket (path given by ifname) and reads and writes raw packets, so might be useful in other than UML contexts. No network interface is created, and the MAC and MTU must be set as appropriate on the other side of the socket. GVPE will exit if the MAC address doesn't match what it expects. Completely untested so far. tincd/cygwin Known to be broken, use native/cygwin instead. SEE ALSO
gvpe(5). AUTHOR
Marc Lehmann <gvpe@schmorp.de> 2.2 2008-09-01 GVPE.OSDEP(5)
All times are GMT -4. The time now is 07:44 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy