summaryrefslogtreecommitdiff
path: root/netsniff-ng.c
AgeCommit message (Collapse)AuthorFilesLines
2015-06-20pcap_io: add cooked mode supportDaniel Borkmann1-0/+17
Originally submitted by Vadim in a different form, he wrote: Use Linux "cooked" header for Netlink interface automatically or as replacement of L2 header if "--cooked" option is specified: http://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL.html 'Cooked headers' makes sense to use for default or nsec pcap types which does not contain protocol info. Added new LINKTYPE_LINUX_SLL which indicates pcap file with Linux "cooked" header as L2 layer header. This pcap file is compatible with Wireshark's "cooked" header & vice-versa. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-06-18netsniff-ng: Add cooked cmdline option.Vadim Kochan1-4/+10
Add a --cooked option that we later on use for capturing in cooked header. For now, this only captures with a dgram packet socket, but the remaining logic will follow up. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [ dbkm: split out patch ] Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-05-11netsniff-ng: Fix typo Unkown -> UnknownKartik Mistry1-2/+2
Fix typo in error message. Signed-off-by: Kartik Mistry <kartik.mistry@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-05-07netsniff-ng: add comment wrt NOATIME and fix whitespaceDaniel Borkmann1-1/+5
Just add a comment to the reader, so that it's obvious. The second condition could have been spared in case of open_or_die(), but it's nothing critical and the extra indent can be spared instead. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-05-07netsniff-ng: Open pcap w/o O_NOATIME on 2nd tryVadim Kochan1-1/+6
If the file open fails with O_NOATIME option then try to open it w/o this option in case if the user does not have enough prvileges to use O_NOATIME. It fixes the case when user made pcap file in sudo mode but after it should still use sudo to read it because of setting O_NOATIME option requires higher privileges. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-05-05die: Rename *_panic_func to *_panic_handlerVadim Kochan1-1/+1
Rename xxx_panic_func(s) to xxx_panic_handler(s) which is more understandable than 'func'. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-05-02netsniff-ng: Show packet numberVadim Kochan1-5/+8
Show the packet number as part of the dissector output. Example: > wlp3s0 107 1430159373s.693002029ns (#5) [ Eth MAC (6c:88:14:ac:51:e4 => 10:fe:ed:90:22:12), Proto (0x0800, IPv4) ] Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-05-01netsniff-ng: alias lb to rr as wellDaniel Borkmann1-1/+2
After all it's round robin mode. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-04-27netsniff-ng nlmsg: Print netlink protocol nameVadim Kochan1-5/+9
nlmsg proto handler can't identify Netlink protocol from nlmsghdr, so sockaddr_ll can be used to get it. Also renamed [proto -> handler] member in pkt_buff struct, which is more understandable. Example: >U nlmon0 4756 1429891435s.14505747ns [ NLMSG Proto 0 (RTNETLINK), Len 1160, Type 0x0010 (0x10), Flags 0x0002 (MULTI), Seq-Nr 1429891436, PID 31613 ] Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Handle usage of NETLINK_SOCK_DIAG with pre 3.10 kernel headers, fix nl_proto2str() return value, formatting changes] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-04-27netsniff-ng: Rotate pcap files prematurely on SIGHUPTobias Klauser1-9/+25
Allow to send SIGHUP to a running netsniff-ng process, causing it to prematurely rotate the output PCAP when the output device (-o/--out) is a directory. The rotating interval (time/file size) will be reset. Suggested by dcode in #140 Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-04-22netsniff-ng: Don't set IO prio when reading pcap fileVadim Kochan1-3/+3
It allows to read pcap file for users who have no permissions to set process IO prio. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Acked-by: Daniel Borkmann <borkmann@iogearbox.net> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-04-22netsniff-ng: Store getgid() result in correct member of struct contextVadim Kochan1-1/+1
Changed to use ctx->gid when call getgid() on init_ctx. Before we were overwriting ctx->uid which clearly is an error. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-04-21netsniff-ng: Delete rfmon mac80211 device in case of panicVadim Kochan1-9/+17
netsniff-ng does not delete created rfmon device in case of panic (for example - bad pcap filter expression), so added ability to add callback func when panic will be happen and delete rfmon device. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-04-21netsniff-ng: add packet fanout supportMichał Purzyński1-5/+49
This work adds packet fanout support to netsniff-ng. Multiple netsniff-ng instances can join the same fanout group with a particular id in order to improve scaling. Based on different fanout disciplines, e.g. distribute to fanout member by packet hash, round-robin, by arrival cpu, by random, by socket rollover (if one members socket queue is full, switch to next one, etc), by hardware queue mapping, traffic can be distributed to one of the fanout members. Moreover, we also allow the user to specify additional aux arguments, e.g. whether to defrag incoming traffic for the fanout group or not, and whether to roll over a socket in case other disciplines than socket rollover have been used. All that is configurable via command line option. Signed-off-by: Michał Purzyński <michalpurzynski1@gmail.com> [ dbkm made some bigger changes to get this upstream ready ] Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-04-13netsniff-ng: Consider radiotap header of monitor devVadim Kochan1-12/+11
netsniff-ng does not check if monitor device includes radiotap header which leads to the wrong 802.11 frame parsing. Tested if the .pcap file is understandable by wireshark and if dump info is basically correct, but did not test the case when xmit packets from .pcap file to the output device and from the input device to the output device. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: whitespace changes] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-03-31netsniff-ng: No trailing whitespaces in generated trafgen config filesTobias Klauser1-1/+4
Make sure we don't print any unnecessary trailing whitespaces to the trafgen config file when converting from pcap. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-02-05xmalloc: Make xrealloc() arguments conform to realloc()Tobias Klauser1-1/+1
xrealloc() has an additional nmemb argument compared to realloc() for which it should serve as a wrapper. Since we always call with nmemb = 1, we might as well remove this argument and thus have xrealloc() conform to the realloc() function prototype. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-01-26netsniff: Allow filter input pcap file to output pcapVadim Kochan1-1/+19
It might be useful to filter out interesting traffic from input pcap to output pcap file which will contain only filtered packets: $ netsniff-ng -i input.pcap -o output.pcap ip src 192.168.1.198 Now it is possible by specifying output pcap file with ".pcap" extension, otherwise the trafgen file will be generated as by default. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: small wording and whitespace adjustment] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-12-12all: Reduce amount of empty liens in usage and version output a bitTobias Klauser1-5/+5
No need for some of the empty lines, remove them to make the output a bit denser. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-10-01netsniff-ng: Combine redundant pcap file rotation logic into functionTobias Klauser1-34/+24
The code to create the next pcap dump file is duplicated for the HAVE_TPACKET3 and !HAVE_TPACKET3 case. Consolidate the functionality into a function to reduce code duplication. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-29netsniff-ng: Fix tpacketv2-only capturingTobias Klauser1-1/+1
We need to set up the RX ring depending on whether tpacket v3 is available or not. Otherwise end up setting its structure up for tpacket v3, even though only tpacket v2 is available. This should fix packet capturing for tpacket v2 (i.e. corrupted frames in pcap). Reported-by: Mike Reeves <luke@geekempire.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-29netsniff-ng: Move variable definitionTobias Klauser1-3/+2
Save one #ifdef block by moving the tpacket v3 only variable definition to the block where it is actually used. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-11netsniff-ng: Remvoe unnecessary cast to void *Tobias Klauser1-2/+1
The iov_base member of struct iovec is already void *, so there is no need to cast it. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-11netsniff-ng: Unindent goto labelTobias Klauser1-2/+1
Stick to the usual style of having goto labels not indented. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-09netsniff-ng: Remove useless check for ctx.device_inTobias Klauser1-2/+1
If ctx.device_in is NULL after option parsing, it is always set to "any", which is before this check. Thus, it serves no purpose and can be removed. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-05netsniff-ng: Don't duplicate copyright/bug report/license stringTobias Klauser1-18/+13
Move the copyright/bug report/license string to an own constant and use it for the output of help() and version() to avoid duplication and prevent the strings from getting out of sync. This makes the text section of netsniff-ng.o slightly smaller: before: text data bss dec hex filename 26998 8 68 27074 69c2 netsniff-ng/netsniff-ng.o after: text data bss dec hex filename 26582 8 68 26658 6822 netsniff-ng/netsniff-ng.o Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-08-14netsniff-ng: Use correct parameters to show_frame_hdr()Tobias Klauser1-1/+2
Commit edca6174b09 ("dissector: Restore paket type if capturing from nlmon device") changed the signature of show_frame_hdr(). The call to this function was not updated in the !HAVE_TPACKET3 part of netsniff-ng introduced in commit 97e6f994785c ("netsniff-ng: Restore tpacket v2 capturing"), causing a compile error. Fix this by providing the correct parameters to show_frame_hdr() also in this case. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-08-14netsniff-ng: Restore tpacket v2 capturingTobias Klauser1-1/+71
Some older systems (e.g. RHEL 6) don't have tpacket v3 available, but only tpacket v2. However, since commit d8cdc6a ("ring: netsniff-ng: migrate capture only to TPACKET_V3") we solely rely on tpacket v3 for capturing packets. This patch restores the possibility to capture using tpacket v2. For now this is just a fallback if the configure script doesn't detect tpacket v3 (and thus HAVE_TPACKET3 isn't set). Thus, on most modern systems this shouldn't change anything and they will continue using tpacket v3. For now this fix contains quite a bit of ugly #ifdefery which should be cleaned up in the future. Fixes #76 Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-08-12netsniff-ng: Add command line option to disable hardware time stampingTobias Klauser1-5/+13
Allow to disable hardware time stamping using the command line switch (-N/--no-hwtimestamp). This might be useful in situations where hardware time stamps are skewed somehow. Reference: #129 Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-06-04dissector: Restore paket type if capturing from nlmon deviceTobias Klauser1-4/+8
The kernel sets the skb pkttype to PACKET_OUTGOING for all packets being sent through dev_queue_xmit_nit(). However, if capturing packets from an nlmon device, this causes the information on whether the netlink packet was sent to kernel- or userspace (PACKET_KERNEL/PACKET_USER) to be overwritten. A previous attempt by Daniel Borkmann to fix this in kernel space [1] by not overwriting the packet type for netlink packets was not regarded as the proper solution. [1] http://patchwork.ozlabs.org/patch/338612/ Thus, attempt to fix this in userspace by looking at the pid field of the netlink packet, which is always 0 for messages to kernel space [2]. [2] http://www.carisma.slowglass.com/~tgr/libnl/doc/core.html#core_netlink_fundamentals Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-12bpf: Zero out socket filter in bpf_parse_rules()Tobias Klauser1-7/+0
Instead of memsetting the struct sock_filter every time before we call bpf_parse_rules(), do it there directly. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-09ring: Merge common ring_{rx,tx} initialization into own functionTobias Klauser1-31/+4
Instead of having to perform the individual steps to initialize a ring and open coding them in multiple places, provide convenience functions to do all at once. This has the nice side effect of allowing to make most of these *_{rx,tx}_ring() functions static in their respective module. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-09netsniff-ng: Move function scope variablesTobias Klauser1-8/+9
Move some variables from the function scipe to the block where they're used solely. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-09netsniff-ng: Remove unnecessary memset of struct pollfdTobias Klauser1-2/+0
rx_poll will be passed to prepare_polling() which already zeros the struct, so no need to do it before. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-09netsniff-ng: Remove unnecessary initialization of struct ctx membersTobias Klauser1-4/+0
These will be set later on depending on command line option (or panic() out) and they're set to 0 by init_ctx() anyways. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-04-30netsniff-ng/ring: Make verbose flag boolTobias Klauser1-3/+3
Change type of verbose flag from int to bool. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-04-30netsniff-ng: Use while() instead of empty forTobias Klauser1-2/+2
Instead of using a foor loop with empty initialization and afterthought, just use a while loop with the same condition. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-04-30ring: Consistently use size_t to specify ring sizeTobias Klauser1-4/+8
The mm_len member of struct ring is of type size_t, but in the code paths leading to set it, unsigned int is used. In circumstances where unsigned int is 32 bit and size_t is 64 bit, this could lead to an integer overflow, which causes an improper ring size being mmap()'ed in mmap_ring_generic(). In order to prevent this, consistently use size_t to store the ring size, since this is also what mmap() takes as its `length' parameter. This now allows to specify ring sizes larger than 4 GiB for both netsniff-ng and trafgen (fixes #90). Reported-by: Jon Schipp <jonschipp@gmail.com> Reported-by: Michał Purzyński <michalpurzynski1@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-04-30netsniff-ng: Fix whitespacesTobias Klauser1-3/+3
Remove some leading/trailing whitespaces. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-04-28netsniff-ng: Remove locally declared labelsTobias Klauser1-13/+4
These usually only make sense for complex macros which are expanded moree than once. The label for `out' doesn't make sense anyhow as it is declared on function level. Also don't indent the labels, so they're clearer to spot. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-04-12built_in: changed to use RUNTIME_PAGE_SIZE instead of PAGE_SIZEChristian Wiese1-1/+1
References: https://github.com/netsniff-ng/netsniff-ng/commit/453f6eb9d79dd5aa2812ef956b22723f0a493086 https://github.com/netsniff-ng/netsniff-ng/pull/112 Signed-off-by: Christian Wiese <chris@opensde.org> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2014-04-07pcap_io: fill sll when reading pcapDaniel Borkmann1-2/+2
When reading from a pcap in Kuznetsov/netsniff-ng format, we currently do not fill out sll. Do so so that users can see pkttype and the interface. Reported-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2014-02-21netsniff-ng: Exit gracefully for all possible termination signalsTobias Klauser1-0/+4
Handle all termination signals that we're allowed to handle (SIGKILL can't be handled) in order to exit gracefully in any regular termination case. Without this fix, pcap files written by netsniff-ng might be corrupted. Reported-by: Mike Westmacott <mikewestmacott@googlemail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-10-10netsniff-ng: Don't modify optarg/argvTobias Klauser1-2/+0
We shouldn't modify optarg (and thus argv) since it's e.g. used to display the commandline string in `ps'. Since strtoul() reads until it encounters the first non-numeric character and ignores the rest, we can just revert from setting a NULL byte after the numeric part of the string. Reported-by: Jon Schipp <jonschipp@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-10-10netsniff-ng: Use strtoul() instead of strtol() for unsigned longTobias Klauser1-4/+4
If setting an unsigned long variable, use strtoul() instead of strtol(). Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-10-02netsniff-ng: modify mmap option in usage to be grammatically correctJon Schipp1-1/+1
Incorrect usage of "i.e." leads one to believe that replaying is possible only. Signed-off-by: Jon Schipp <jonschipp@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-09-30netsniff-ng: Display pcap I/O method in verbose modeTobias Klauser1-0/+3
If a user accidentially specifies more than one of --mm/--sg/--clrw, the option specified last will be used - as expected from standard command line tools. In order to still prevent users from being confused by this, explicitely display the pcap I/O method used in verbose mode. In order for the output to be more user-friendly, actually write out the method names in const char *pcap_ops_group_to_str, which isn't used anywhere else anyway. Suggested-by: Jon Schipp <jonschipp@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-09-02netsniff-ng: Remove unnecessary fmemset() of struct statTobias Klauser1-1/+0
The struct stat is filled by the call to stat(2) in the next line, so there is no need to explicitely set it to 0 before. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-08-30netsniff-ng: Simplify dump file creation logicTobias Klauser1-9/+5
Instead of using goto, just check stats if stat() returned 0 and used ctx->dump_dir afterwards. This makes the logic a bit easier to follow. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-08-19netsniff-ng: poll: don't panic on EINTRDaniel Borkmann1-4/+8
When signal occurs, don't panic on EINTR, rather gracefully return. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-22 14:26:01 +0000