Find the answer to your Linux question:
Results 1 to 5 of 5
i've registered hook-function with netfilter(NF_IP_PRE_ROUTING), so i have an ability to watch every packet, that comes from the network. I want to know, is there are any methods to look ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined! Alex_Justes's Avatar
    Join Date
    Apr 2010
    Posts
    11

    [SOLVED] Problem with filtering network packets


    i've registered hook-function with netfilter(NF_IP_PRE_ROUTING), so i have an ability to watch every packet, that comes from the network. I want to know, is there are any methods to look into the data part of the packet(i.e. http headers)?

    here is the problem:
    skb->len returns right size of the whole packet, but when i read skb->len bytes from skb->data i get only ip and tcp headers and then some strange bytes(no correct data(i.e. http headers))) (skb have type struct sk_buff *)

    P.S.
    Kernel - 2.6.31

  2. #2
    Linux Guru Lazydog's Avatar
    Join Date
    Jun 2004
    Location
    The Keystone State
    Posts
    2,677
    Have you looked at tcpdump or wireshark for capturing the packets? They both will caputer the complete packet data and all.

    Regards
    Robert

    Linux
    The adventure of a life time.

    Linux User #296285
    Get Counted

  3. #3
    Just Joined! Alex_Justes's Avatar
    Join Date
    Apr 2010
    Posts
    11
    >>tcpdump or wireshark

    It appears, that they are using pcap library, so they can only capture. However i need tools to modify packet on the fly(depending on it's contents). As i know, pcap doesn't provides such capabilities.

  4. $spacer_open
    $spacer_close
  5. #4
    Just Joined! Alex_Justes's Avatar
    Join Date
    Apr 2010
    Posts
    11

    Lightbulb

    Seems to be i solve one part of that puzzle:

    if (skb->data_len > 0) then the packet is fragmented(i.e. protocol headers stays in the skb->data, other contents of the packet are situated in some fragments)

    skb_shinfo(skb)->frags - it is pointer to an array of fragments of our packet
    skb_shinfo(skb)->nr_frags - it is amount of such fragments

    Each entry in this array is struct skb_frag_struct(see comment), so, it seems to be possible to get data from different pages. =)

    /*
    struct skb_frag_struct{
    struct page *page;
    __u32 page_offset;
    __u32 size;
    };
    */

  6. #5
    Just Joined! Alex_Justes's Avatar
    Join Date
    Apr 2010
    Posts
    11

    Arrow Lazy Solution

    I've found lazy but simple solution =)

    skb_linearize(skb); - makes fragmented sk_buff to linear one. So you can read skb->len bytes from skb->data without any problems with pages and packet's fragments.


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •