[lkml]   [1998]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectHow to snoop a network device on recent kernels?
    Is there any documentation on the approved method for snooping network devices 
    in recent kernels, especially with IP masquerading. I'm having problems with

    The code below, if I understand it correctly, should open a socket which sees
    both outgoing and incoming on the ISDN link, but nothing else...

    struct ifreq ifr;
    int snoopfd;
    struct sockaddr_ll sll;

    snoopfd = socket(AF_PACKET,SOCK_DGRAM, 0);
    strcpy(ifr.ifr_name, "ippp0");

    ioctl(snoopfd, SIOCGIFINDEX, &ifr);
    sll.sll_family = AF_PACKET;
    sll.sll_protocol = htons(ETH_P_ALL);
    sll.sll_ifindex = ifr.ifr_ifindex;

    bind (snoopfd, &sll, sizeof(sll));

    However, if I run this on my IP Masquerading dial-up box, the outgoing packets
    show up OK, but the incoming packets are already rewritten to the masqueraded
    (internal) address before I see them.

    Even Alexey's new tcpdump shows this problem: pinging from an
    internal machine shows the following:

    18:08:18.973142 > icmp: echo request
    18:08:19.193142 > devel2.axiom.internal: icmp: echo reply
    18:08:19.973036 > icmp: echo request
    18:08:20.193036 > devel2.axiom.internal: icmp: echo reply

    This causes diald to think that two different connections are open, one from
    the internal machine, and one from the firewall. As it only sees one FIN
    packet go by, it only ever closes one of the connections, and my ISDN link
    stays up for ages waiting for connections that are already dead.

    So what should I (or diald) be doing?

    ---- ---- ----
    David Woodhouse Office: (+44) 1223 812896
    Project Leader, Process Information Systems Mobile: (+44) 976 658355
    Axiom (Cambridge) Ltd., Swaffham Bulbeck, Cambridge, CB5 0NA, UK.
    finger for PGP key.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:44    [W:0.033 / U:36.988 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site