lkml.org 
[lkml]   [1998]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectHow to snoop a network device on recent kernels?
    Date
    From
    Is there any documentation on the approved method for snooping network devices 
    in recent kernels, especially with IP masquerading. I'm having problems with
    diald.

    The code below, if I understand it correctly, should open a socket which sees
    both outgoing and incoming on the ISDN link, but nothing else...

    {
    struct ifreq ifr;
    int snoopfd;
    struct sockaddr_ll sll;

    snoopfd = socket(AF_PACKET,SOCK_DGRAM, 0);
    strcpy(ifr.ifr_name, "ippp0");

    ioctl(snoopfd, SIOCGIFINDEX, &ifr);
    sll.sll_family = AF_PACKET;
    sll.sll_protocol = htons(ETH_P_ALL);
    sll.sll_ifindex = ifr.ifr_ifindex;

    bind (snoopfd, &sll, sizeof(sll));
    }


    However, if I run this on my IP Masquerading dial-up box, the outgoing packets
    show up OK, but the incoming packets are already rewritten to the masqueraded
    (internal) address before I see them.


    Even Alexey's new tcpdump shows this problem: pinging www.caldera.com from an
    internal machine shows the following:

    18:08:18.973142 axiom.demon.co.uk > rim.caldera.com: icmp: echo request
    18:08:19.193142 rim.caldera.com > devel2.axiom.internal: icmp: echo reply
    18:08:19.973036 axiom.demon.co.uk > rim.caldera.com: icmp: echo request
    18:08:20.193036 rim.caldera.com > devel2.axiom.internal: icmp: echo reply

    This causes diald to think that two different connections are open, one from
    the internal machine, and one from the firewall. As it only sees one FIN
    packet go by, it only ever closes one of the connections, and my ISDN link
    stays up for ages waiting for connections that are already dead.

    So what should I (or diald) be doing?



    ---- ---- ----
    David Woodhouse David.Woodhouse@mvhi.com Office: (+44) 1223 812896
    Project Leader, Process Information Systems Mobile: (+44) 976 658355
    Axiom (Cambridge) Ltd., Swaffham Bulbeck, Cambridge, CB5 0NA, UK.
    finger dwmw2@ferret.lmh.ox.ac.uk for PGP key.



    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

    \
     
     \ /
      Last update: 2005-03-22 13:44    [W:0.029 / U:29.296 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site