Date: Fri, 21 Apr 2006 09:14:19 -0500 From: Guy Helmer <ghelmer@palisadesys.com> To: Amit Mondal <amit.freebsd@gmail.com> Cc: freebsd-net@freebsd.org Subject: Re: freeBSD /ipfw/ divert socket Message-ID: <4448E8BB.2070609@palisadesys.com> In-Reply-To: <a6cf19a10604202244q40dd981dq66b56f435ee245c8@mail.gmail.com> References: <a6cf19a10604202244q40dd981dq66b56f435ee245c8@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Amit Mondal wrote: > Hi All, > > I need a little help with FreeBSD Kernel stuff. I wanna use Divert Socket to > sniff IP packet in FreeBSD. > For that I have compiled the kernel with options IPDIVERT and everything is > ok. > > Now, when I am not really sniffing and re-injecting the packet back to the > network stack, it is basically dropping all the packets. But I want it > pass-through it, when no application is reading at divert socket. My > question is, HOW CAN I MAKE IT PASS-THROUGH? IF NO APPLICATION IS READING > FROM DIVERT SOCKET, IT SHOULD WORK AS IF THERE IS NO DIVERT SOCKET. > > Thanks in adavnce > > Rgds > Amit > > Speaking from experience, it would be trivial to borrow sys/netgraph/ng_tee.c and modify it to pass packets through the left2right and right2left hooks when the hooks are connected, and pass packets directly right or left when the left2right and right2left hooks aren't connected. Then netgraph sockets can be constructed from userland programs to connect to the left2right and right2left hook. Packets will be passed to your program when your sockets are connected, and otherwise packets will skip right through the modified netgraph tee when the sockets aren't connected. Hope this helps, Guy -- Guy Helmer, Ph.D. Principal System Architect Palisade Systems, Inc.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4448E8BB.2070609>