diff options
| -rw-r--r-- | netsniff-ng.8 | 27 |
1 files changed, 13 insertions, 14 deletions
diff --git a/netsniff-ng.8 b/netsniff-ng.8 index 5bdc6d0..bc99123 100644 --- a/netsniff-ng.8 +++ b/netsniff-ng.8 @@ -21,18 +21,17 @@ started working on netsniff-ng, the pcap(3) library did not use this zero-copy facility. .PP netsniff-ng is Linux specific, meaning there is no support for other -operating systems, thus we can keep the code footprint quite minimal and to +operating systems. Therefore we can keep the code footprint quite minimal and to the point. Linux packet(7) sockets and its RX_RING and TX_RING interfaces -bypass the normal packet processing path through the networking stack. Thus, -this is the fastest one can get out of the box in terms of capturing or -transmission performance from user space, without having to load unsupported -or non-mainline third-party kernel modules. We explicitly refuse to build -netsniff-ng on top of ntop/PF_RING. Not because we do not like it (we do find -it interesting), but because of the fact that it is not part of the mainline -kernel. Therefore, the ntop project has to maintain and sync out-of-tree drivers -to adapt them to their DNA. Eventually, we went for untainted Linux kernel, -since its code has a higher rate of review, maintenance, security and bug -fixes. +bypass the normal packet processing path through the networking stack. +This is the fastest capturing or transmission performance one can get from user +space out of the box, without having to load unsupported or non-mainline +third-party kernel modules. We explicitly refuse to build netsniff-ng on top of +ntop/PF_RING. Not because we do not like it (we do find it interesting), but +because of the fact that it is not part of the mainline kernel. Therefore, the +ntop project has to maintain and sync out-of-tree drivers to adapt them to their +DNA. Eventually, we went for untainted Linux kernel, since its code has a higher +rate of review, maintenance, security and bug fixes. .PP netsniff-ng also supports early packet filtering in the kernel. It has support for low-level and high-level packet filters that are translated into Berkeley @@ -46,7 +45,7 @@ intervals, thus, making it a useful backend tool for subsequent traffic analysis. .PP netsniff-ng itself also supports analysis, replaying, and dumping of raw 802.11 -frames. For online or offline analysis, netsniff-ng has a built in packet +frames. For online or offline analysis, netsniff-ng has a built-in packet dissector for the current 802.3 (Ethernet), 802.11* (WLAN), ARP, MPLS, 802.1Q (VLAN), 802.1QinQ, LLDP, IPv4, IPv6, ICMPv4, ICMPv6, IGMP, TCP and UDP, including GeoIP location analysis. Since netsniff-ng does not establish any @@ -66,7 +65,7 @@ eventually. .SH OPTIONS .PP .SS -i <dev|pcap|->, -d <dev|pcap|->, --in <dev|pcap|->, --dev <dev|pcap|-> -Defines an input device, that can either be a networking device, a pcap file +Defines an input device. This can either be a networking device, a pcap file or stdin (\[lq]-\[rq]). In case of a pcap file, the pcap type (\[lq]-D\[rq] option) is determined automatically by the pcap file magic. In case of stdin, it is assumed that the input stream is a pcap file. @@ -170,7 +169,7 @@ to disc. .PP .SS -S <size>, --ring-size <size> Manually define the RX_RING resp. TX_RING size in \[lq]<num>KiB/MiB/GiB\[rq]. By -default the size is determined based on the network connectivity rate. +default, the size is determined based on the network connectivity rate. .PP .SS -k <uint>, --kernel-pull <uint> Manually define the interval in micro-seconds where the kernel should be triggered |