Re: freeBSD /ipfw/ divert socket

Amit Mondal wrote:
Hi All,

I need a little help with FreeBSD Kernel stuff. I wanna use Divert Socket to
sniff IP packet in FreeBSD.
For that I have compiled the kernel with options IPDIVERT and everything is
ok.

Now, when I am not really sniffing and re-injecting the packet back to the
network stack, it is basically dropping all the packets. But I want it
pass-through it, when no application is reading at divert socket. My
question is, HOW CAN I MAKE IT PASS-THROUGH? IF NO APPLICATION IS READING
FROM DIVERT SOCKET, IT SHOULD WORK AS IF THERE IS NO DIVERT SOCKET.

Thanks in adavnce

Rgds
Amit

Speaking from experience, it would be trivial to borrow sys/netgraph/ng_tee.c and modify it to pass packets through the left2right and right2left hooks when the hooks are connected, and pass packets directly right or left when the left2right and right2left hooks aren't connected. Then netgraph sockets can be constructed from userland programs to connect to the left2right and right2left hook. Packets will be passed to your program when your sockets are connected, and otherwise packets will skip right through the modified netgraph tee when the sockets aren't connected.

Hope this helps,
Guy

--
Guy Helmer, Ph.D.
Principal System Architect
Palisade Systems, Inc.

_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Changing TOS of forwarded packets?
    ... use ipfw to send sessions that match to a divert socket at port X. ... (he's looking at ethernet packets where you would be looking at IP ... My little goodie is a netgraph node for packet mangling in its ...
    (freebsd-net)
  • Re: Avoiding natd overhead
    ... On 10/22/06, Vladimir Grebenschikov wrote: ... > addresses BEFORE translation and then unregistered source ... I don't know how I could send packets ... > better term, a "kernel divert socket," which would ...
    (freebsd-net)
  • Re: Avoiding natd overhead
    ... is necessary if you want to catch unregistered destination ... addresses BEFORE translation and then unregistered source ... I don't know how I could send packets ... better term, a "kernel divert socket," which would ...
    (freebsd-net)
  • Re: netgraph question : how to intercept incoming IP packets of a certain type?
    ... >>Ethernet interface of a certain type (e.g RSVP) and call my own ... >>promising for this task but I can not figure out how to do it in ... use ipfw divert to send packets to it. ...
    (freebsd-net)
  • Re: freeBSD /ipfw/ divert socket
    ... when no application is reading at divert socket. ... Send a copy of packets matching this rule to the divertsocket ... bound to port port. ...
    (freebsd-net)