Re: bpf packet capture and SOCK_STREAM socket redirects...

Hi Alireza Torabi!

On Thu, 20 Mar 2008 10:57:39 +0000; Alireza Torabi wrote about 'Re: bpf packet capture and SOCK_STREAM socket redirects...':

That's sort of the problem. I've got a data link capture of the packet
(bpf) and let say I redirect this packet to a SOCK_STREAM on another
machine and the whole thing will work fine (OK after rewritting some
mac and ip and checksums...).

I just need to do this on the SOCK_STREAM of the same machine. If I
try to put it in another way:

Is it possible to do a bpf write of a packet that can be seen by the
interface the bpf is bound to?

AFAIK, no.

This means that the interface does it's normal work and the packet
will be deliverd to SOCK_STREAM bound to it.

What exactly is your task? May be it is worth consider some other ways if
additional details are known.

--
WBR, Vadim Goncharov. ICQ#166852181 mailto:vadim_nuclight@xxxxxxx
[Moderator of RU.ANTI-ECOLOGY][FreeBSD][http://antigreen.org][LJ:/nuclight]

_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: libpcap perf improvement? latest ideas?
    ... performance (with comparison of linux and freebsd) I searched freebsd resources for pcap improvements. ... I agree that a reference model can be used to reduce the number of copies done currently for BPF. ... In PF_PACKET you are forced to do a system call per-acquisition and another system for receiving the time-stamp of the last packet read for example. ... I proposed a model that allows for dynamic ring buffer size and signaling for soft and hard-limits to allow application buffering to handle potential drops. ...
    (freebsd-hackers)
  • Re: crash when bpf is used heavily
    ... It looks like the BPF code is written to handle the case where allocation ... but that it passes flags to the memory allocator that prevent the ... I've worked with that need to do processing of many high speed packet ...
    (freebsd-current)
  • Re: Implementation of Sampling for BPF
    ... BPF was never intended to be reliable every-packet solution. ... every packet, I am looking at attempting to define which packets it discards so that there is an equal chance of sampling something that happens, rather then an unknown/unpredictable chance. ... Putting as many servers as needed does scale well if you need only sampled data - just put an appropriate sampler/load balancer before them. ...
    (freebsd-net)
  • Re: bpf writes on tun device
    ... >> would mean that we have to change it everywhere, including bpf ... >> integer in front of everything else which is raw data', ... packet starts and where the actual raw IP packet starts. ... If you want BPF/PCAP to return packets without the 4-byte offset, ...
    (freebsd-net)
  • Re: Implementation of Sampling for BPF
    ... BPF was never intended to be reliable every-packet solution. ... I'm not looking to transform BPF into a solution to reliably sample every packet, I am looking at attempting to define which packets it discards so that there is an equal chance of sampling something that happens, rather then an unknown/unpredictable chance. ...
    (freebsd-net)