Sponsored Content
Top Forums Programming Raw Socket Programming - Efficient Packet Sniffer Post 302826141 by rstnsrr on Wednesday 26th of June 2013 05:01:57 AM
Old 06-26-2013
Raw Socket Programming - Efficient Packet Sniffer

Hi,
I have the requirement to sniff packets from
the Ethernet card on my Linux machine and
process it and feed it to a RANAP protocol stack.
So far I have written the raw packet sniffer
and successfully sniffing packets and do little
processing. However, for huge number of packets
pumped from external machines, the sniffer will face packet loss!!


How to make the sniffer more efficient??
How can I segregate the processing part
from receiving part ?How can I use multi threading
and/or select() system calls to receive and
process packets without packet loss??

Regards,
Royz

Last edited by rstnsrr; 06-26-2013 at 06:12 AM..
 

9 More Discussions You Might Find Interesting

1. Programming

Getting an ACK for RAW SYN packet

Hi, I'm trying to create a RAW TCP SYN packet and send it from one Linux machine to another. I know the packet I have created is well formed and is received by the peer. Now what I want is to get an ACK for my SYN. I want the peer's Network protocol stack to send me an ACK for that. I know... (17 Replies)
Discussion started by: zampya
17 Replies

2. Linux

Kernel programming: packet divertion

Hi All, Not sure if this is the right place to ask, so please tell me where is appropriate... Anyway, here is the problem. I'm a bit new to kernel programming, so nothing works :confused: . I need to intercept cetrtain ethernet packets from Host1("eth0") to Host2("eth1") and send them to... (1 Reply)
Discussion started by: sl_king
1 Replies

3. Programming

sendto in packet socket

Hi, I have created a packet socket (PF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP)) to catch the ARP packets coming to my machine and send appropriate reply. Now I'm able to recieve the ARP requests using recvfrom but don't know how to send the reply. I looked into man page but I'm not able to... (5 Replies)
Discussion started by: Rakesh Ranjan
5 Replies

4. Programming

RAW socket and CONFIG_FILTER

Hi, Im doin a project on DHCp client-server setup. i have to use RAW sockets in the code for this. The call PF_PACKET, SOCK_RAW as the first two arguments. The code compiles but when i try to start the Dhcp client, I get an error saying "Make sure CONFIG_PACKET and CONFIG_FILTER is enabled". I... (4 Replies)
Discussion started by: yannifan
4 Replies

5. IP Networking

Changing the source IP?? using RAW Socket.

Hi There, Suppoose we have configured logical Interface 2.2.2.2 on a server with Primary IP 1.1.1.1. Now when I am sending a packet from this server, is it possible to make receiver assume that this packet has come from IP 2.2.2.2 and not 1.1.1.1 I think it is possibl using RAW sockets??? but... (1 Reply)
Discussion started by: Ankit_Jain
1 Replies

6. UNIX for Advanced & Expert Users

Why root permissions required for creating of RAW Socket

To create RAW socket in Unix/Linux why should one have root permissions? Any other work around to create raw sockets in Unix/Linux using a normal login id? Since I don't have super user credentials and I want to create RAW sockets. Let me know if you are aware of any work around. (3 Replies)
Discussion started by: anilgurwara
3 Replies

7. Programming

Writing a Packet sniffer

Hi, I want to write a packet sniffer in C without using libpcap. Can anyone suggest me how to begin writing it? Any tutorials or books? Thanks in advance! (2 Replies)
Discussion started by: nefarious_genus
2 Replies

8. IP Networking

Raw Sockets Programming

Hi everybody!! I'm studding at the university raw sockets, but i can't find a good place to read about them... Does anybody now where i can find some information??? I've been goggling a lot but couldn't find nothing useful, just man pages... by the way, I'm programming under Linux... Bye! (4 Replies)
Discussion started by: Sandia_man
4 Replies

9. Programming

Receiving broadcast packets using packet socket

Hello I try to send DHCP RENEW packets to the network and receive the responses. I broadcast the packet and I can see that it's successfully sent using Wireshark. But I have difficulties receiving the responses.I use packet sockets to catch the packets. I can see that there are responses to my... (0 Replies)
Discussion started by: xyzt
0 Replies
RANDPKT(1)						  The Wireshark Network Analyzer						RANDPKT(1)

NAME
randpkt - Random Packet Generator SYNOPSIS
randpkt [ -b <maxbytes> ] [ -c <count> ] [ -t <type> ] <filename> DESCRIPTION
randpkt is a small utility that creates a pcap trace file full of random packets. By creating many randomized packets of a certain type, you can test packet sniffers to see how well they handle malformed packets. The sniffer can never trust the data that it sees in the packet because you can always sniff a very bad packet that conforms to no standard. randpkt produces very bad packets. When creating packets of a certain type, randpkt uses a sample packet that is stored internally to randpkt. It uses this as the starting point for your random packets, and then adds extra random bytes to the end of this sample packet. For example, if you choose to create random ARP packets, randpkt will create a packet which contains a predetermined Ethernet II header, with the Type field set to ARP. After the Ethernet II header, it will put a random number of bytes with random values. OPTIONS
-b <maxbytes> Default 5000. Defines the maximum number of bytes added to the sample packet. If you choose a maxbytes value that is less than the size of the sample packet, then your packets would contain only the sample packet... not much variance there! randpkt exits on that condition. -c <count> Default 1000. Defines the number of packets to generate. -t <type> Default Ethernet II frame. Defines the type of packet to generate: arp Address Resolution Protocol bgp Border Gateway Protocol bvlc BACnet Virtual Link Control dns Domain Name Service eth Ethernet fddi Fiber Distributed Data Interface giop General Inter-ORB Protocol icmp Internet Control Message Protocol ip Internet Protocol llc Logical Link Control m2m WiMAX M2M Encapsulation Protocol megaco MEGACO nbns NetBIOS-over-TCP Name Service ncp2222 NetWare Core Protocol sctp Stream Control Transmission Protocol syslog Syslog message tds TDS NetLib tcp Transmission Control Protocol tr Token-Ring udp User Datagram Protocol usb Universal Serial Bus usb-linux Universal Serial Bus with Linux specific header EXAMPLES
To see a description of the randpkt options use: randpkt To generate a capture file with 1000 DNS packets use: randpkt -b 500 -t dns rand_dns.pcap To generate a small capture file with just a single LLC frame use: randpkt -b 100 -c 1 -t llc single_llc.pcap SEE ALSO
pcap(3), editcap(1) 1.10.3 2013-07-28 RANDPKT(1)
All times are GMT -4. The time now is 03:38 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy