Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3971 > unrolled thread

read IP header

Back to article view | Back to comp.os.linux.networking

Contents

  read IP header "Bill Cunningham" <nospam@nspam.invalid> - 2017-02-14 13:49 -0500
    Re: read IP header Rick Jones <rick.jones2@hpe.com> - 2017-02-14 21:19 +0000
    Re: read IP header Jorgen Grahn <grahn+nntp@snipabacken.se> - 2017-02-14 21:52 +0000
      Re: read IP header "Bill Cunningham" <nospam@nspam.invalid> - 2017-02-15 13:34 -0500
        Re: read IP header Jorgen Grahn <grahn+nntp@snipabacken.se> - 2017-02-15 19:12 +0000
          Re: read IP header "Bill Cunningham" <nospam@nspam.invalid> - 2017-02-15 14:54 -0500
            Re: read IP header Jorgen Grahn <grahn+nntp@snipabacken.se> - 2017-02-16 07:04 +0000

#3971 — read IP header

    Can you look at the IP header with libpcap? I do know it works with the 
link layer. If I wanted to write smoething to capture packets and read the 
IP header, as an experiment what would I need other than libpcap? I am 
thinking sockets. For the connection. Just a networking program experiment.

    Bill

[toc] | [next] | [standalone]

#3972

Bill Cunningham <nospam@nspam.invalid> wrote:
>     Can you look at the IP header with libpcap? I do know it works
> with the link layer. If I wanted to write smoething to capture
> packets and read the IP header, as an experiment what would I need
> other than libpcap? I am thinking sockets. For the connection. Just
> a networking program experiment.

libpcap captures the first N bytes of a packet.  Make N large enough
and it will include the IP header for IP traffic.

rick jones
-- 
The glass is neither half-empty nor half-full. The glass has a leak.
The real question is "Can it be patched?"
these opinions are mine, all mine; HPE might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hpe.com but NOT BOTH...

[toc] | [prev] | [next] | [standalone]

#3975

On Tue, 2017-02-14, Bill Cunningham wrote:
>     Can you look at the IP header with libpcap? I do know it works with the 
> link layer. If I wanted to write smoething to capture packets and read the 
> IP header, as an experiment what would I need other than libpcap? I am 
> thinking sockets.

No, you just need libpcap, and RFC 791. (And you need to understand
the link-layer headers, so you can move past them to the IPv4 packet
which they may or may not contain.)

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#3976

"Jorgen Grahn" <grahn+nntp@snipabacken.se> wrote in message 
news:slrnoa6v0i.vnt.grahn+nntp@frailea.sa.invalid...
> On Tue, 2017-02-14, Bill Cunningham wrote:
>>     Can you look at the IP header with libpcap? I do know it works with 
>> the
>> link layer. If I wanted to write smoething to capture packets and read 
>> the
>> IP header, as an experiment what would I need other than libpcap? I am
>> thinking sockets.
>
> No, you just need libpcap, and RFC 791. (And you need to understand
> the link-layer headers, so you can move past them to the IPv4 packet
> which they may or may not contain.)
>
> /Jorgen

    pcap_finddev on my machine returns a "nflog" as a device. Does anyone 
know what this is?

Bill

[toc] | [prev] | [next] | [standalone]

#3977

On Wed, 2017-02-15, Bill Cunningham wrote:
>
> "Jorgen Grahn" <grahn+nntp@snipabacken.se> wrote in message 
> news:slrnoa6v0i.vnt.grahn+nntp@frailea.sa.invalid...
>> On Tue, 2017-02-14, Bill Cunningham wrote:
>>>     Can you look at the IP header with libpcap? I do know it works with 
>>> the
>>> link layer. If I wanted to write smoething to capture packets and read 
>>> the
>>> IP header, as an experiment what would I need other than libpcap? I am
>>> thinking sockets.
>>
>> No, you just need libpcap, and RFC 791. (And you need to understand
>> the link-layer headers, so you can move past them to the IPv4 packet
>> which they may or may not contain.)
>>
>> /Jorgen
>
>     pcap_finddev on my machine returns a "nflog" as a device. Does anyone 
> know what this is?

I do, but I only had to spend five seconds googling to learn.

Seems similar to OpenBSD's pflog0.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#3978

"Jorgen Grahn" <grahn+nntp@snipabacken.se> wrote in message 
news:slrnoa9a1g.vnt.grahn+nntp@frailea.sa.invalid...

> I do, but I only had to spend five seconds googling to learn.

    I had to spend a helluv a lot more. And still don't get it. It's a new 
version of something else.

> Seems similar to OpenBSD's pflog0.

    Never heard of it.

> /Jorgen
>
Bill

[toc] | [prev] | [next] | [standalone]

#3979

On Wed, 2017-02-15, Bill Cunningham wrote:
>
> "Jorgen Grahn" <grahn+nntp@snipabacken.se> wrote in message 
> news:slrnoa9a1g.vnt.grahn+nntp@frailea.sa.invalid...
>
>> I do, but I only had to spend five seconds googling to learn.
>
>     I had to spend a helluv a lot more. And still don't get it. It's a new 
> version of something else.

E.g. the first hit, https://wiki.wireshark.org/CaptureSetup/NFLOG

They're saying you can configure the Linux firewalling/netfilter stuff
so that it copies packets to a nflog device, presumably while blocking
those packets.

But don't let this distract you from your project. You don't need to
understand every (pseudo-)network interface on your machine in order to
analyze IP headers.

>> Seems similar to OpenBSD's pflog0.
>
>     Never heard of it.

Fair enough; it was meant as a reference you could look up. The first
hit there is http://www.openbsd.org/faq/pf/logging.html .  But that's
just for comparison.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web