Conversation

Notices

1. Embed this notice
   Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Wednesday, 02-Oct-2024 20:23:51 JST Ryan Castellucci :nonbinary_flag:

   Have any of you implemented a program that captures packets using an AF_PACKET socket rather than using libpcap?

   I want to write something to compile statically and run on embedded devices. libpcap is a bit big.

   • Embed this notice
     Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Wednesday, 02-Oct-2024 20:25:38 JST Ryan Castellucci :nonbinary_flag:

     in reply to

     I've already figured out how to generate BPF program structures directly and bind them to the socket, which is the really annoying bit, and the packets per second will be low enough that I don't need a ring buffer or anything fancy.

   • Embed this notice
     Royce Williams (tychotithonus@infosec.exchange)'s status on Wednesday, 02-Oct-2024 23:11:32 JST Royce Williams

     in reply to

     @ryanc massscan may be useful reference code:

     https://github.com/robertdavidgraham/masscan

   • Embed this notice
     Leah Neukirchen (leah@blahaj.social)'s status on Thursday, 03-Oct-2024 01:11:18 JST Leah Neukirchen

     in reply to

     @ryanc just recvmsg should work, no?

   • Embed this notice
     Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Thursday, 03-Oct-2024 15:44:36 JST Ryan Castellucci :nonbinary_flag:

     in reply to

     • Royce Williams

     @tychotithonus It does not appear to use AF_PACKET sockets.

   • Embed this notice
     Royce Williams (tychotithonus@infosec.exchange)'s status on Thursday, 03-Oct-2024 15:47:42 JST Royce Williams

     in reply to

     @ryanc Erk - sorry!