| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 18 Oct 2011 22:41:26 +0200 From: Bruno Prémont <bonbons@...ux-vserver.org> To: raviraj joshi <raviraj.j1991@...il.com> Cc: linux-kernel@...r.kernel.org Subject: Re: kenel level packet capturing Hi, You would probably have more/better replies if you asked netdev <netdev@...r.kernel.org>. On Tue, 18 October 2011 raviraj joshi <raviraj.j1991@...il.com> wrote: > We are making a kernel level packet capture module as a part of our BE project . > We are finding it difficult to understand kenel networking code. > We studied structures and functions like sk_buff, netif_rx(),dev_alloc_skb. > How ever we were not able to trace the actual path a simple packet follows. > Moreover we tried to count the no of times netif_rx function was > called it was much much lower than amount of packets actually being > received. netif_rx may fetch more than a single packet from the network interface controller in order to improve performance. > Can anyone please let us know the reason for this and how to approach > the problem of writing a kernel level packet capture module. The better place to capture packets is probably by hooking somewhere into netfilter code as all packets traverse it (assuming it is loaded/enabled). Bruno > regards, > Raviraj Joshi > PICT,Pune. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists