summaryrefslogtreecommitdiff
path: root/netsniff-ng
AgeCommit message (Collapse)AuthorFilesLines
2018-01-12netsniff-ng: add DCCP supportMarkus Amend1-0/+1
Adds a first rudimentary support for the DCCP protocol. Signed-off-by: Markus Amend <markus.amend@telekom.de> [tk: minor formatting tweaks] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2016-08-05netsniff-ng: Allow to compile without libnlVadim Kochan1-10/+17
One might not want to install libnl just for sniffing packets, for example if netsniff-ng will be compiled on embedded or switch system. Hide libnl dependend code if CONFIG_LIBNL=0. In case the `--rfraw' option is used, the user will get a panic message. In case of netlink messages being sniffed, they will not be dissected. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-11-16lookup: Use lookup module for OUI lookup as wellTobias Klauser1-1/+0
Do not needlessly duplicate code between the oui and the lookup module. Instead, add an additional lookup table for OUIs to the lookup module. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-20bpf: Use sysctl helpers to enable bpf jit compilerVadim Kochan1-0/+1
Use sysctl helpers to set /proc/sys/net/core/bpf_jit_enable param. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-06-20netsniff-ng: Add dissector for Linux "cooked" packetsVadim Kochan1-0/+1
Added dissector_sll.c which uses sockaddr_ll to lookup & print higher L3 layer protocol. This dissector is mapped by LINKTYPE_LINUX_SLL link type. Sample output of dissected Netlink & Ethernet packets. Truncated manually some longer lines by "...": > nlmon0 20 1434193547s.717131169ns #6 [ Linux "cooked" Pkt Type 4 (outgoing), If Type 824 (netlink), Addr Len 0, Src (), Proto 0x0 ] [ NLMSG Family 0 (routing), Len 20, Type 0x0003 (DONE)... > wlp3s0 52 1434194181s.436224709ns #9 [ Linux "cooked" Pkt Type 4 (outgoing), If Type 1 (ether), Addr Len 6, Src (XX:XX:XX:XX:XX:XX), Proto 0x800 ] [ IPv4 Addr (XXX.XXX.XXX.XXX => 212.42.76.253), Proto (6), TTL (64), TOS (0), ... ), CSum (0x1ef5) is ok ] [ Geo (local => Ukraine) ] [ TCP Port (45849 => 443 (https)), SN (0x1744209), AN (0x46ca9611), DataOff (8) ... [ Chr .....w.Rj).. ] [ Hex XX XX XX XX XX XX XX XX XX XX XX XX ] Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-06-01netsniff-ng, nlmsg: Dissect rtnl link type messagesVadim Kochan1-0/+2
Dump RTnetlink interface related info with attributes. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-04-23build: Restore support for cross-compiling the netsniff-ng toolkitTobias Klauser1-4/+4
Ever since we switched to the hand-crafted ./configure script, support for cross-compiling the netsniff-ng toolkit was basically broken. Restore the abaility to cross-compile our tools by making ./configure consider the CROSS_COMPILE and SYSROOT variables. Example for cross-compiling on arm: $ CROSS_COMPILE=arm-linux-gnueabihf- \ SYSROOT=/usr/arm-linux-gnueabihf \ ./configure $ make assuming the cross-compiled libraries (and their respective pkg-config information) are in /usr/arm-linux-gnueabihf. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-04-21netsniff-ng: Delete rfmon mac80211 device in case of panicVadim Kochan1-0/+1
netsniff-ng does not delete created rfmon device in case of panic (for example - bad pcap filter expression), so added ability to add callback func when panic will be happen and delete rfmon device. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-06-16dissector: Get rid of now unnecessary HAVE_DISSECTOR_PROTOSTobias Klauser1-1/+1
Since commit 1cc762a ("lookup: Move UDP/TCP port and Ethernet type lookup into own module") the netsniff-ng tool is the only one using the dissector infrastructure. Thus we no longer need to conditionally device HAVE_DISSECTOR_PROTOS, since netsniff-ng is the only tool defining this. While at it, also remove the __WITH_PROTOS macro which is checked in dissector_init_ethernet/dissector_cleanup_ethernet but is defined nowhere. This will cause the functions to be called from both the ethernet and ieee80211 dissectors, thus make sure we check the initialization state before freeing as well. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-06-13lookup: Move UDP/TCP port and Ethernet type lookup into own moduleTobias Klauser1-0/+1
Up to now, the lookup of TCP/UDP port names and Ethernet types was tightly integrated with the dissector infrastructure, since it is its main user. However, flowtop also makes use of the name lookup functionality without needing the actual dissector infrastructure. Thus, the basic dissector infrastructure also needs to be linked into flowtop without actually being used. Fix this by extracting the port/ethertype lookup into an own module which can then be used either directly (for flowtop) or as part of the dissector infrastructure (for netsniff-ng). This also reverts the quick & dirty fix introduced in commit f3322c6 ("flowtop: Include netlink dissector to fix build temporarily"). Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-28netsniff-ng: Add netlink dissectorTobias Klauser1-0/+2
Add an initial implementation of a dissector to work on netlink messages as received from an nlmon device. Use can use it as follows to monitor netlink traffic to/from the kernel: modprobe nlmon ip link add type nlmon ip link set nlmon0 up netsniff-ng -i nlmon0 ip link set nlmon 0 down ip link del dev nlmon0 rmmod nlmon Fixes: #89 Suggested-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-08-09dev: Integrate `promisc' module into `dev' moduleTobias Klauser1-1/+0
Since entering/leaving promiscuous mode also is a device specific function and all users of the `promisc' module also use `dev', integrate it there. Also rename the functions to have a `device_' prefix like the other functions in the module. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-07-30build: reduce Extra contents to bare minimumDaniel Borkmann1-0/+6
Improve the build system, so that configuration files are installed per tool basis. Also, introduce post_install targets, so that config files can be altered in some way, e.g. done by trafgen. Moreover, move custom targets from Extra to tool-specific Makefiles. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-07-12bpf_comp: pass NEED_TCPDUMP_LIKE_FILTER through gccDaniel Borkmann1-1/+1
We have to pass NEED_TCPDUMP_LIKE_FILTER define through gcc as it otherwise is not possible to let the pcap compiler invoke through netsniff-ng, but not through astraceroute. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-07-11dissector: rename __WITH_PROTOS into HAVE_DISSECTOR_PROTOSDaniel Borkmann1-1/+1
To be more consistent with config.h, rename __WITH_PROTOS into HAVE_DISSECTOR_PROTOS. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-07-11build: refactor tool specific flags into <tool>/MakefileDaniel Borkmann1-0/+4
To get the normal Makefile a bit cleaner, push the tool specific build options into <tool>/Makefile. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-07-11configure, netsniff-ng: if no libgeopip, do not link against libzDaniel Borkmann1-5/+5
In netsniff-ng, we only use libz in combination with libgeoip, so if we lack either one of them, do not link against the other either. This would be a waste otherwise. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-07-11configure, netsniff-ng: make netsniff-ng's geoip dependency optionalDaniel Borkmann1-3/+7
Geoip dependency should not be mandatory as it's not a core part of netsniff-ng. This also facilitates compilation on platforms where geoip is not available. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-07-09configure: fix multiple issues in build configurationDaniel Borkmann1-1/+3
This patch is a bundle of multiple fixes. 1) Fix compilation of astraceroute when HAVE_LIBPCAP=1: astraceroute doesn't need libpcap, so add an additional guard/define to bpf.h and bpf_comp.c and netsniff-ng.c. Also since we generate a config.h file, we do not need to have this additional compile flag anymore. 2) Fix tstamping.{h,c} to use the configure script instead of the Makefile. For doing this, also fix the object inclusion in netsniff-ng/Makefile. Last but not least, rename __WITH_... into HAVE_... as this is more clean. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-07-08configure: netsniff-ng: libpcap is not a hard dependencyDaniel Borkmann1-2/+8
netsniff-ng uses libpcap only for high-level filter compiling. Thus, let netsniff-ng not "hard-depend" on libpcap, but rather disable filter compiling in case the user does not want to install libpcap. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04xutils: eliminate xutils, move rest to epoll2Daniel Borkmann1-1/+0
Finally eliminate xutils.{c,h} and move the rest to epoll2. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04timer: add time management functionsDaniel Borkmann1-0/+1
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04sig: add signal handling functionsDaniel Borkmann1-0/+1
Add an extra file for signal handling functions. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04link: add link management functionsDaniel Borkmann1-0/+1
Same here as usual, break out link functions from xutils. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04sock: add socket management functionsDaniel Borkmann1-0/+1
Remove them from xutils, and add them to socket management. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04proc: move out process specific management functionsDaniel Borkmann1-0/+1
Move them out of xutils, so that we can maintain them separately. Also simplify things a bit. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04privs: move drop_privileges out of xutilsDaniel Borkmann1-0/+1
Again, also to be able to maintain this more easily. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04xutils: move device management functions out of xutilsDaniel Borkmann1-0/+1
Move those functions out so that they can be more easily maintained in its separate file. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04xutils: break out promisc mode functionsDaniel Borkmann1-0/+1
Put them separately for the sake of maintanence. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04xio: rename xio to ioops and reduce its includesDaniel Borkmann1-1/+1
Rename xio to ioops (io-ops) and boil its include files down to a minimum. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-04xutils: break out string handling and lockingDaniel Borkmann1-0/+1
Break out all string handling functions and lockme stuff in order to further eliminate the big code blob in xutils, so that it can be easier maintained. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-03iosched: break out io scheduling functions from xutilsDaniel Borkmann1-0/+1
Break this stuff out, for better maintainability and readability. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-06-03irq: break out from xutils and save + restoreDaniel Borkmann1-0/+1
Break out IRQ functionality from xutils, simplify it, and save + restore IRQ affinity list. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-05-31ring: move duplicate/generic code parts from rx/tx into ring.cDaniel Borkmann1-0/+1
We do not want to maintain duplicate code, so move this into a separate file and name those *_generic() helpers. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-05-13ring: break out timestamping since not directly relatedDaniel Borkmann1-0/+1
Break out the timestamping part of the ring.h file, since it's not directly related to the {t,r}x_ring. Also inlining doesn't make sense here. Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-03-15netsniff-ng trafgen: Find libnl-3.0 and libnl-genl-3.0 using pkg-configPeter Stuge1-2/+2
Call pkg-config --cflags and pkg-config --libs to find correct CFLAGS and LDFLAGS respectively. Signed-off-by: Peter Stuge <peter@stuge.se> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
2013-03-15all: import netsniff-ng 0.5.8-rc0 sourceDaniel Borkmann2-0/+54
We decided to get rid of the old Git history and start a new one for several reasons: *) Allow / enforce only high-quality commits (which was not the case for many commits in the history), have a policy that is more close to the one from the Linux kernel. With high quality commits, we mean code that is logically split into commits and commit messages that are signed-off and have a proper subject and message body. We do not allow automatic Github merges anymore, since they are total bullshit. However, we will either cherry-pick your patches or pull them manually. *) The old archive was about ~27MB for no particular good reason. This basically derived from the bad decision that also some PDF files where stored there. From this moment onwards, no binary objects are allowed to be stored in this repository anymore. The old archive is not wiped away from the Internet. You will still be able to find it, e.g. on git.cryptoism.org etc. Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-04 01:43:36 +0000