Sponsored Content
Top Forums Programming Raw Socket Programming - Efficient Packet Sniffer Post 302831207 by DGPickett on Wednesday 10th of July 2013 12:10:28 PM
Old 07-10-2013
Yes, a master thread could pull packets from the socket and put them on one of N queues in rotation, for N threads to process. All N threads can access the same structured container, and can exploit multiple CPU cores. N should be the count of cores times 2. The process should be reusing the same buffers, allocated at startup, perhaps 4N or more, lowest first for locality of reference. Another thread might merge streams of used buffers from the N threads into one list of available buffers, fifo for locality of reference. You need mutex locks to control access to the fifo list, but the queues can be structured for simultaneous read and write, 2^n ring-buffer style. Welcome to multi-threading and buffering. Luckily, IP packet processing does not care if packets are reordered, so released packets can go into queues to a packet return demux thread that merges them into one queue for return to the stream. Hopefully the kernel / firewall API supposrts this flow.

Last edited by DGPickett; 07-10-2013 at 01:46 PM..
This User Gave Thanks to DGPickett For This Post:
 

9 More Discussions You Might Find Interesting

1. Programming

Getting an ACK for RAW SYN packet

Hi, I'm trying to create a RAW TCP SYN packet and send it from one Linux machine to another. I know the packet I have created is well formed and is received by the peer. Now what I want is to get an ACK for my SYN. I want the peer's Network protocol stack to send me an ACK for that. I know... (17 Replies)
Discussion started by: zampya
17 Replies

2. Linux

Kernel programming: packet divertion

Hi All, Not sure if this is the right place to ask, so please tell me where is appropriate... Anyway, here is the problem. I'm a bit new to kernel programming, so nothing works :confused: . I need to intercept cetrtain ethernet packets from Host1("eth0") to Host2("eth1") and send them to... (1 Reply)
Discussion started by: sl_king
1 Replies

3. Programming

sendto in packet socket

Hi, I have created a packet socket (PF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP)) to catch the ARP packets coming to my machine and send appropriate reply. Now I'm able to recieve the ARP requests using recvfrom but don't know how to send the reply. I looked into man page but I'm not able to... (5 Replies)
Discussion started by: Rakesh Ranjan
5 Replies

4. Programming

RAW socket and CONFIG_FILTER

Hi, Im doin a project on DHCp client-server setup. i have to use RAW sockets in the code for this. The call PF_PACKET, SOCK_RAW as the first two arguments. The code compiles but when i try to start the Dhcp client, I get an error saying "Make sure CONFIG_PACKET and CONFIG_FILTER is enabled". I... (4 Replies)
Discussion started by: yannifan
4 Replies

5. IP Networking

Changing the source IP?? using RAW Socket.

Hi There, Suppoose we have configured logical Interface 2.2.2.2 on a server with Primary IP 1.1.1.1. Now when I am sending a packet from this server, is it possible to make receiver assume that this packet has come from IP 2.2.2.2 and not 1.1.1.1 I think it is possibl using RAW sockets??? but... (1 Reply)
Discussion started by: Ankit_Jain
1 Replies

6. UNIX for Advanced & Expert Users

Why root permissions required for creating of RAW Socket

To create RAW socket in Unix/Linux why should one have root permissions? Any other work around to create raw sockets in Unix/Linux using a normal login id? Since I don't have super user credentials and I want to create RAW sockets. Let me know if you are aware of any work around. (3 Replies)
Discussion started by: anilgurwara
3 Replies

7. Programming

Writing a Packet sniffer

Hi, I want to write a packet sniffer in C without using libpcap. Can anyone suggest me how to begin writing it? Any tutorials or books? Thanks in advance! (2 Replies)
Discussion started by: nefarious_genus
2 Replies

8. IP Networking

Raw Sockets Programming

Hi everybody!! I'm studding at the university raw sockets, but i can't find a good place to read about them... Does anybody now where i can find some information??? I've been goggling a lot but couldn't find nothing useful, just man pages... by the way, I'm programming under Linux... Bye! (4 Replies)
Discussion started by: Sandia_man
4 Replies

9. Programming

Receiving broadcast packets using packet socket

Hello I try to send DHCP RENEW packets to the network and receive the responses. I broadcast the packet and I can see that it's successfully sent using Wireshark. But I have difficulties receiving the responses.I use packet sockets to catch the packets. I can see that there are responses to my... (0 Replies)
Discussion started by: xyzt
0 Replies
PPPOE-SNIFF(8)                                                System Manager's Manual                                               PPPOE-SNIFF(8)

NAME
pppoe-sniff - examine network for non-standard PPPoE frames SYNOPSIS
pppoe-sniff [options] DESCRIPTION
pppoe-sniff listens for likely-looking PPPoE PADR and session frames and deduces extra options required for pppoe(8) to work. Some DSL providers seem to use non-standard frame types for PPPoE frames, and/or require a certain value in the Service-Name field. It is often easier to sniff those values from a machine which can successfully connect rather than try to pry them out of the DSL provider. To use pppoe-sniff, you need two computers, a DSL modem and an Ethernet hub (not an Ethernet switch.) If the DSL modem normally connects directly to your computer's Ethernet card, connect it to the "uplink" port on the Ethernet hub. Plug two computers into normal ports on the hub. On one computer, run whatever software the DSL provider gave you on whatever operating system the DSL provider supports. On the other computer, run Linux and log in as root. On the Linux machine, put the Ethernet interface into promiscuous mode and start pppoe-sniff. If the ethernet interface is eth0, for exam- ple, type these commands: ifconfig eth0 promisc pppoe-sniff -I eth0 On the other machine, start your DSL connection as usual. After a short time, pppoe-sniff should print recommendations for the value of PPPOE_EXTRA. Set this value in /etc/ppp/pppoe.conf. If pppoe-sniff indicates that something special is required in PPPOE_EXTRA, please e- mail this to pppoe@roaringpenguin.com along with the name of your ISP and the manufacturer and model number of your DSL modem. This infor- mation will be collated and provided on the PPPoE web page for users who do not have two computers. After pppoe-sniff finishes (or you stop it if it seems hung), remember to turn off promiscuous mode: ifconfig eth0 -promisc OPTIONS
-I interface The -I option specifies the Ethernet interface to use. Under Linux, it is typically eth0 or eth1. The interface should be "up" and in promiscuous mode before you start pppoe-sniff. -V The -V option causes pppoe-sniff to print its version number and exit. BUGS
pppoe-sniff only works on Linux. AUTHORS
pppoe-sniff was written by David F. Skoll <dfs@roaringpenguin.com>. The pppoe home page is http://www.roaringpenguin.com/pppoe/. SEE ALSO
pppd(8), pppoe(8), pppoe-sniff(8), pppoe-relay(8), /usr/share/doc/pppoe/README.Debian.gz 4th Berkeley Distribution 3 July 2000 PPPOE-SNIFF(8)
All times are GMT -4. The time now is 01:18 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy