kenel level packet capturing

kenel level packet capturing

[raviraj joshi]

We are making a kernel level packet capture module as a part of our BE project .
We are finding it difficult to understand kenel networking code.
We studied structures and functions like sk_buff, netif_rx(),dev_alloc_skb.
How ever we were not able to trace the actual path a simple packet follows.
Moreover we tried to count the no of times netif_rx function was
called it was much much lower than amount of packets actually being
received.
Can anyone please let us know the reason for this and how to approach
the problem of writing a kernel level packet capture module.

regards,
Raviraj Joshi
PICT,Pune.

Re: kenel level packet capturing

[Bruno Prémont]

Hi,

You would probably have more/better replies if you asked netdev <netdev@vger.kernel.org>.

On Tue, 18 October 2011 raviraj joshi <raviraj.j1991@gmail.com> wrote:
> We are making a kernel level packet capture module as a part of our BE project .
> We are finding it difficult to understand kenel networking code.
> We studied structures and functions like sk_buff, netif_rx(),dev_alloc_skb.
> How ever we were not able to trace the actual path a simple packet follows.
> Moreover we tried to count the no of times netif_rx function was
> called it was much much lower than amount of packets actually being
> received.

netif_rx may fetch more than a single packet from the network interface
controller in order to improve performance.

> Can anyone please let us know the reason for this and how to approach
> the problem of writing a kernel level packet capture module.

The better place to capture packets is probably by hooking somewhere into
netfilter code as all packets traverse it (assuming it is loaded/enabled).

Bruno


> regards,
> Raviraj Joshi
> PICT,Pune.