[lkml]   [1998]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectHow to snoop a network device on recent kernels?
Is there any documentation on the approved method for snooping network devices 
in recent kernels, especially with IP masquerading. I'm having problems with

The code below, if I understand it correctly, should open a socket which sees
both outgoing and incoming on the ISDN link, but nothing else...

struct ifreq ifr;
int snoopfd;
struct sockaddr_ll sll;

snoopfd = socket(AF_PACKET,SOCK_DGRAM, 0);
strcpy(ifr.ifr_name, "ippp0");

ioctl(snoopfd, SIOCGIFINDEX, &ifr);
sll.sll_family = AF_PACKET;
sll.sll_protocol = htons(ETH_P_ALL);
sll.sll_ifindex = ifr.ifr_ifindex;

bind (snoopfd, &sll, sizeof(sll));

However, if I run this on my IP Masquerading dial-up box, the outgoing packets
show up OK, but the incoming packets are already rewritten to the masqueraded
(internal) address before I see them.

Even Alexey's new tcpdump shows this problem: pinging from an
internal machine shows the following:

18:08:18.973142 > icmp: echo request
18:08:19.193142 > devel2.axiom.internal: icmp: echo reply
18:08:19.973036 > icmp: echo request
18:08:20.193036 > devel2.axiom.internal: icmp: echo reply

This causes diald to think that two different connections are open, one from
the internal machine, and one from the firewall. As it only sees one FIN
packet go by, it only ever closes one of the connections, and my ISDN link
stays up for ages waiting for connections that are already dead.

So what should I (or diald) be doing?

---- ---- ----
David Woodhouse Office: (+44) 1223 812896
Project Leader, Process Information Systems Mobile: (+44) 976 658355
Axiom (Cambridge) Ltd., Swaffham Bulbeck, Cambridge, CB5 0NA, UK.
finger for PGP key.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:44    [W:0.047 / U:0.616 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site