I'm using packet_mmap to capture all packets in the system, but there doesn't seem to be any way to interfere with the rest of the OS getting them as well. I want to be able to have exclusive control over packets coming into userland and decide whether they get to go onto other applications in the system or if they get dropped, so I can filter the packets based on criteria.
Is there any method of doing this? I can't seem to find any documentation on this particular subject. I guess what I want is to be able to remove all incoming packets from the IP stack so no other program gets them, and then be able to reinsert packets on a packet-by-packet basis.
You can't do what you want with PACKET sockets - they're not designed for that purpose.
What you need to use instead is libnetfilter_queue, together with an iptables rule that directs all incoming packets to your queue.
Related
Is there a way to view all the IPv4 packets sent to a Linux computer?
I know I can capture the packets at the ethernet level using libpcap. This can work, but I don't really want to defragment the IPv4 packets. Does libpcap provide this functionality and I'm just missing it?
One thing that kinda works is using a tun device. I can capture all the IPv4 traffic by routing all traffic to the tun device via something like ip route add default via $TUN_IP dev $TUNID. This also stops outbound traffic though, which is not what I want.
I just want to see the IPv4 packets, not intercept them. (Or, even better, optionally intercept them.)
Edit: I'm specifically looking for a programmatic interface to do this. E.g. something I can use from within a C program.
Yes, you can see all the packets that arrive at your network interface. There are several options to access or view them. Here a small list of possible solutions, where the first one is the easiest and the last one the hardest to utilize:
Wireshark
I'd say this is pretty much the standard when it comes to protocol analyzers with a GUI (uses libpcap). It has tons of options, a nice GUI, great filtering capabilities and reassembles IP datagrams. It uses libpcap and can also show the raw ethernet frame data. For example it allows you to see layer 2 packets like ARP. Furthermore you can capture the complete data arriving at your network interface in a file that can later be analyzed (also in Wireshark).
tcpdump
Very powerful, similar features like Wireshark but a command line utility, which also uses libpcap. Can also capture/dump the complete interface traffic to a file. You can view the dumped data in Wireshark since the format is compatible.
ngrep
This is known as the "network grep" and is similar to tcpdump but supports regular expressions (regex) to filter the payload data. It allows to save captured data in the file format supported by Wireshark and tcpdump (also uses libpcap).
libnids
Quotation from the official git repository:
"Libnids is a library that provides a functionality of one of NIDS
(Network Intrusion Detection System) components, namely E-component. It means
that libnids code watches all local network traffic [...] and provides convenient information on them to
analyzing modules of NIDS. Libnids performs:
assembly of TCP segments into TCP streams
IP defragmentation
TCP port scan detection"
libpcap
Of course you can also write your own programs by using the library directly. Needless to say, this requires more efforts.
Raw or Packet Sockets
In case you want to do all the dirty work yourself, this is the low level option, which of course also allows you to do everything you want. The tools listed above use them as a common basis. Raw sockets operate on OSI layer 3 and packet sockets on layer 2.
Note: This is not meant to be a complete list of available tools or options. I'm sure there are much more but these are the most common ones I can think of.
Technically you have to make a copy of the received packet via libpcap. To be more specific, what you can do is to get packets with libpcap, that way the packets will be kind of blocked, so you need to re send them to the destination. Lets say that you want to make a Fire-Wall or something, what you should do is to have a layer that can work like getting the package and then send it to the destination, in between you can make a copy of what you got for further processes. In order to make the intercept option, you need to create some predefined rules, i.e. the ones that violates the rules will not be send again to their destination.
But that needs a lot of efforts and I don't think you want to waist your life on it.
Wire-shark as mentioned by #Barmar can do the job already.
If you need some kind of command line interface option I would say that "tcpdump" is one of the best monitoring tools. for example for capturing all ipv4 HTTP packets to and from port 80 the command will be:
tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
for more information and options see tcpdump
Please be specific if you need to write a program for it, then we can help about how to do it.
First a little background: I have an idea for a chat application. I don't want the user to need to put in connection details, so I was thinking I can send a custom ethernet packet type. That packet is received by peers; generating a database of every peer within the user's application. I don't want to overcomplicate generating my raw packets. What is the minimum amount of data required in order to send a successfully received packet? Do any special circumstances exist where a minimal packet will transmit properly with some hardware, and not other hardware?
Let me clarify, and be explicit: I am asking what is the minimum amount of information required in the packet for that packet to be transmitted, and received. An example of information that can be found in an ethernet packet is an IP address, a hardware address, time-to-live, et cetera.
What is the mimimum amount of data required in order to send a
successfully received packet?
You don't need to use IP at all if you aren't going to send this over the internet.
On your LAN you could get by with a custom network layer if you like.
There are also existing nonip protocols (IPX) which may be suiting your needs. IPX is relatively simple to set up but people will be mad at you if they ever catch you using it.
(I also have no idea if windows supports IPX since winxp).
That would be the hard way.
The easier way would be to use UDP/IP. UDP is designed to be minimal.
The wiki page for UDP will tell you the header size of a UDP datagram.
Don't forget to add the IP header (wiki again) and ethernet frame (ibid.) to this.
Finally you need a payload.
There are many many options. It depends largely on the network infrastructure you intend to use. If your infrastructure is IP over Ethernet then you'll be stuck with that!
Do any special circumstances exist where a minimal packet will
transmit properly with some hardware, and not other hardware?
If you adhere to the standards: No. If you flaunt the standards: Very probably.
In your latter question you seem to be hinting you would like to employ 'clever' tricks to minimize packet size (ie, missing out non-critical parts of the header(s)), but I repeat: DO NOT GO AGAINST THE STANDARDS.
People will be very very dissapointed with you if the catch you doing this and you will lose all your friends.
The project I am working has the requirement of dropping captured packets. I am successfully captuing packets with the use of libpcap like so,
pcap_loop(handle, num_packets, got_packet, NULL);
Where in the callback function I capture the given number of packets in the num_packets argument. My requirement is to drop the captured packets.
I tried checking for help and ended up empty handed. Any reference of code snippets to perform this requirement of dropping captured packets via libpcap is much appreciated. :)
EDIT
Alternative suggestions are welcome if this is not possible via libpcap.
NOTE that before dropping the packet I need to obtain the destination/ source ip address and payload of the packet to be dropped.
I don't know, if there's a library. Libpcap is for network packet capture only, AFAIK.
From my limited knowledge, I would say dropping a packet is just ignoring or not forwarding it. However this is not done in some program, but the kernel's network stack.
You can accomplish this, by defining appropriate rules in netfilter. There, you will also find libnftnl, which allows to communicate with the Linux netfilter subsystem. But as I read it, you can only define rules and not drop individual packets.
I'm trying to make a custom packet using C using the TCP/IP protocol. When I say custom, I mean being able to change any value from the packet; ex: MAC, IP address and so on.
I tried searching around but I can't find anything that is actually guiding me or giving me example source codes.
How can I create a custom packet or where should I look for guidance?
A relatively easy tool to do this that is portable is libpcap. It's better known for receiving raw packets (and indeed it's better you play with that first as you can compare received packets with your hand crafted ones) but the little known pcap_sendpacket will actually send a raw packet.
If you want to do it from scratch yourself, open a socket with AF_PACKET and SOCK_RAW (that's for Linux, other OS's may vary) - for example see http://austinmarton.wordpress.com/2011/09/14/sending-raw-ethernet-packets-from-a-specific-interface-in-c-on-linux/ and the full code at https://gist.github.com/austinmarton/1922600 . Note you need to be root (or more accurately have the appropriate capability) to do this.
Also note that if you are trying to send raw tcp/udp packets, one problem you will have is disabling the network stack automatically processing the reply (either by treating it as addressed to an existing IP address or attempting to forward it).
Doing this sort of this is not as simple as you think. Controlling the data above the IP layer is relatively easy using normal socket APIs, but controlling data below is a bit more involved. Most operating systems make changing lower-level protocol information difficult since the kernel itself manages network connections and doesn't want you messing things up. Beyond that, there are other platform differences, network controls, etc that can play havoc on you.
You should look into some of the libraries that are out there to do this. Some examples:
libnet - http://libnet.sourceforge.net/
libdnet - http://libdnet.sourceforge.net/
If your goal is to spoof packets, you should read up on network-based spoofing mitigation techniques too (for example egress filtering to prevent spoofed packets from exiting a network).
It's not just a capture I'm looking to do here. I want to first capture the packet, then in real time, check the payload for specific data, remove it, inject a signature and reinject the packet into the stack to be sent on as before.
I had a read of the ipfw divert sockets using IPFW and it looks very promising. What about examples in modifying packets and reinjecting them back into the stack using divert sockets? Also, as a matter of curiosity, would it be possible to read the data from the socket using Java or would this restrict me with packing mangling and reinjecting etc?
See divert sockets: Divert Sockets mini HOWTO.
They work by passing traffic matching a certain ipfw rule to a special raw socket that can then reinject altered traffic into the network layers.
If you're just looking for packet capture, libpcap is very popular. It's used in basic tools such as tcpdump and ethereal. As far as "hooking into the stack", unless you plan on fundamentally changing the way the way the networking is implemented (i.e. add your own layer or alter the behavior of TCP), your idea of using IPF for packet modification or intervention seems like the best bet. In Linux they have a specific redirection target for userspace modules, IPF probably has something similar or you could modify IPF to do something similar.
If you are just interested in seeing the packets, then libpcap is the way to go. You can find it at: http://www.tcpdump.org/
It's possible to do this in userspace with the QUEUE or NFQUEUE iptables target I think. The client application attaches to a queue and receives all matching packets, which it can modify before they're re-injected (it can also drop them if it wants).
There is a client library libnetfilter_queue which it needs to link against. Sadly documentation is minimal, but there are some mailing list posts and examples knocking around.
For performance reasons, you won't want to do this to every packet, but only specific matching ones, which you'll have to match using standard iptables rules. If that doesn't do enough, you'll need to write your own netfilter kernel module.
I was going to echo other responses that have recommended iptables (depending on the complexity of both the patterns that you're trying to match and the packet modifications that you want to make) - until I took notice of the BSD tag on the question.
As Stephen Pellicer has already mentioned, libpcap is a good option for capturing the packets. I believe, though, that libpcap can also be used to send packets. For reference I'm pretty sure that tcpreplay uses it to replay pcap formatted files.