Re: kenel level packet capturing

[Bruno PrÃmont]

Hi,

You would probably have more/better replies if you asked netdev <netdev@xxxxxxxxxxxxxxx>.

On Tue, 18 October 2011 raviraj joshi <raviraj.j1991@xxxxxxxxx> wrote:
> We are making a kernel level packet capture module as a part of our BE project .
> We are finding it difficult to understand kenel networking code.
> We studied structures and functions like sk_buff, netif_rx(),dev_alloc_skb.
> How ever we were not able to trace the actual path a simple packet follows.
> Moreover we tried to count the no of times netif_rx function was
> called it was much much lower than amount of packets actually being
> received.

netif_rx may fetch more than a single packet from the network interface
controller in order to improve performance.

> Can anyone please let us know the reason for this and how to approach
> the problem of writing a kernel level packet capture module.

The better place to capture packets is probably by hooking somewhere into
netfilter code as all packets traverse it (assuming it is loaded/enabled).

Bruno


> regards,
> Raviraj Joshi
> PICT,Pune.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/