Re: bpf packet capture and SOCK_STREAM socket redirects...

On Thu, Mar 20, 2008 at 11:27:53AM +0000, Alireza Torabi wrote:
Imagine this:

| (1)
packets
| | (4)
[nic1] [nic2]
bpf SOCK_STREAM
| (2) |
[FreeBSD] (3)

1) all user traffic are being monitored
2) bpf on [nic] is capturing these packets
3) after processing we know a connection is about to be established from A to B

NOW:
4) I want to deliver this packet to the socket on [nic2]
and as this is a tcp socket it'll take care of it from there
(my code here for this sockets sends and arbitary data to A making it
think it came from B)

Have a look at divert(4). I suspect it comes closest to what you want.

--
Peter Jeremy
Please excuse any delays as the result of my ISP's inability to implement
an MTA that is either RFC2821-compliant or matches their claimed behaviour.

Attachment: pgpugDm8y8cHF.pgp
Description: PGP signature

Relevant Pages

  • Re: Socket Disconnect
    ... That is, if you are periodically sending packets, you'll find out ... > dies that the connection is broken. ... In that case, the stack will detect ... > but, when all of those attempts fail, it will close the socket and you'll ...
    (microsoft.public.dotnet.framework.compactframework)
  • Re: Problem with writing fast UDP server
    ... UDP packets per second. ... socket and threads. ... I wrote a simple case test: client and server. ... The maximum theoretical limit is 14,880 frames per ...
    (comp.lang.python)
  • RE: *warning* student question
    ... What option is this supposed CRC or hash supposed to be? ... >their shell session you're taking over their network socket. ... Systems will also drop TCP packets with bad checksums. ... We provide Ethical Hacking, Advanced Ethical Hacking, Intrusion ...
    (Security-Basics)
  • Re: [patch 4/10] s390: network driver.
    ... but it seems someone is complaining about some behavior changing? ... network driver discard packets on link-down. ... However this approach doesnt play well if the socket can ... be blocked completely because of /one/ interface having its link ...
    (Linux-Kernel)
  • Re: Socket Disconnect
    ... To notice that a connection has been broken, you either have to try to send ... In that case, the stack will detect ... but, when all of those attempts fail, it will close the socket and you'll ... If you are sitting around waiting to receive packets, though, you'll never ...
    (microsoft.public.dotnet.framework.compactframework)