How to snoop a network device on recent kernels?

David Woodhouse (David.Woodhouse@mvhi.com)
Fri, 21 Aug 1998 18:26:43 +0100


Is there any documentation on the approved method for snooping network devices
in recent kernels, especially with IP masquerading. I'm having problems with
diald.

The code below, if I understand it correctly, should open a socket which sees
both outgoing and incoming on the ISDN link, but nothing else...

{
struct ifreq ifr;
int snoopfd;
struct sockaddr_ll sll;

snoopfd = socket(AF_PACKET,SOCK_DGRAM, 0);
strcpy(ifr.ifr_name, "ippp0");

ioctl(snoopfd, SIOCGIFINDEX, &ifr);
sll.sll_family = AF_PACKET;
sll.sll_protocol = htons(ETH_P_ALL);
sll.sll_ifindex = ifr.ifr_ifindex;

bind (snoopfd, &sll, sizeof(sll));
}

However, if I run this on my IP Masquerading dial-up box, the outgoing packets
show up OK, but the incoming packets are already rewritten to the masqueraded
(internal) address before I see them.

Even Alexey's new tcpdump shows this problem: pinging www.caldera.com from an
internal machine shows the following:

18:08:18.973142 axiom.demon.co.uk > rim.caldera.com: icmp: echo request
18:08:19.193142 rim.caldera.com > devel2.axiom.internal: icmp: echo reply
18:08:19.973036 axiom.demon.co.uk > rim.caldera.com: icmp: echo request
18:08:20.193036 rim.caldera.com > devel2.axiom.internal: icmp: echo reply

This causes diald to think that two different connections are open, one from
the internal machine, and one from the firewall. As it only sees one FIN
packet go by, it only ever closes one of the connections, and my ISDN link
stays up for ages waiting for connections that are already dead.

So what should I (or diald) be doing?

---- ---- ----
David Woodhouse David.Woodhouse@mvhi.com Office: (+44) 1223 812896
Project Leader, Process Information Systems Mobile: (+44) 976 658355
Axiom (Cambridge) Ltd., Swaffham Bulbeck, Cambridge, CB5 0NA, UK.
finger dwmw2@ferret.lmh.ox.ac.uk for PGP key.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html