How to do packet analysis (extracting packet information from the stack)?

How to do packet analysis (extracting packet information from the stack)?

Post by gii » Wed, 07 May 2003 11:11:11



Hi,

        I have a question regarding packet analysis. Is there an easy way for
analyzing packets (header + payload) besides using the libpcap library
(http://sourceforge.net/projects/libpcap/)? If such a way exists  or if
you know about other libraries, please let me know... Thanks a lot... ;-))

Have a nice day,

Gabriel

 
 
 

How to do packet analysis (extracting packet information from the stack)?

Post by ynotsso » Wed, 07 May 2003 11:32:37



> I have a question regarding packet analysis. Is there an easy way for
> analyzing packets (header + payload) besides using the libpcap library
> (http://sourceforge.net/projects/libpcap/)? If such a way exists  or if
> you know about other libraries, please let me know... Thanks a lot... ;-))

ethereal does a good job of dissecting the packet structure, and stating
each component and its content.

http://sourceforge.net/projects/ethereal/

         tony

--
use hotmail com for any email replies

-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----==  Over 80,000 Newsgroups - 16 Different Servers! =-----

 
 
 

1. Packets from bottom of TCP/IP stack direct to application bypassing stack

Hello Everyone

I am working on a ADSL modem and have the following situation that I
would like to have some advice on.

I need to filter out some packages in the lower level of the network
stack. There are 2 types of packages: [eth | ppp | ip | udp] and [eth
| ip | udp], the data in these packages are the same and they can be
identified with the first 16 bits in the UDP data.

I have manage to catch these packages in the /net/core/dev.c file and
function netif_rx(...) with the 16 bit ID so I have the packages.

Now for my question: How do I in an easy way get these packages
directly to my application without using the network stack. I need
BOTH of these packages to reach there and if I use socket the one with
PPP get thrown away somewhere and that is not so good.

I know this is not a very specific question and a little vague but
some advice and pointers would be appreciated.

Regards
Andreas

2. Acuserver on Linux

3. Ping localhost: 0 packets received, 100% packet loss RedHat 6.2

4. getting 2.3.xx experimental kernel

5. Dropped packets, bogus packets and errors with SMC Elite 16 Plus

6. Solaris server performance issue.

7. high packet loss w/ packet size > 1024 byte

8. printcap entry for LJII ?

9. "Packet log" analysis

10. unix tcp/udp packet analysis software

11. Duplicate packets on every packet

12. How to convert TCP/IP packet to IPX packet and visa-versa ?

13. IP packets over PPP hang, but LCP packets continue.