On Tue, May 05, 2015 at 04:39:51PM +0200, Daniel Borkmann wrote:
> On 05/05/2015 12:10 PM, Daniel Borkmann wrote:
> >On 05/05/2015 11:26 AM, Tobias Klauser wrote:
> >>On 2015-05-02 at 22:54:50 +0200, Vadim Kochan <[email protected]> wrote:
> >>>On Sat, May 02, 2015 at 07:00:53PM +0200, Tobias Klauser wrote:
> >>>>On 2015-04-29 at 21:18:24 +0200, Vadim Kochan <[email protected]> wrote:
> >>>>>From: Vadim Kochan <[email protected]>
> >>>>>
> >>>>>It might be related to the issue #73 noticed by
> >>>>>
> >>>>> Jon Schipp <[email protected]>
> >>>>>
> >>>>>where he pointed that netsniff-ng captures some extra packets.
> >>>>>
> >>>>>I observed this issue when I captured few Ethernet frames from
> >>>>>wireless device while I was sniffing Netlink monitor device (!!!),
> >>>>>especially under high load traffic (HD Video).
> ...
> >The better fix would just be to consolidate pf_socket() and pf_tx_socket()
> >and allocate both with socket(PF_PACKET, SOCK_RAW, 0). That way, we
> >should also be able to avoid the synchronize_net() barrier (as po->running
> >is false at bind time).
> >
> >If we change pf_socket(), the only thing we need to make sure is that
> >all such sockets do a proper bind() call before starting to capture
> >packets, so that we don't break anything.
>
> Vadim, feel free to follow-up on that with a fix based on above suggestion,
> as you've already investigated and proposed a first patch.
>
> Thanks,
> Daniel
OK, seems this approach fixes the issue, also I checked that all callers
of pf_socket uses bind_generic or ring_{rx,tx}_setup which does a bind a
socket to a device/proto packet handler:
astraceroute.c:893: static int main_trace(struct ctx *ctx) OK
netsniff-ng.c:222: static void pcap_to_xmit(struct ctx *ctx) OK
netsniff-ng.c:388: receive_to_xmit(struct ctx *ctx) OK
netsniff-ng.c:389: receive_to_xmit(struct ctx *ctx) OK
netsniff-ng.c:950: recv_only_or_dump(struct ctx *ctx) OK
So the fix is simply to use a socket(PF_PACKET, SOCK_RAW, 0) in pf_socket func,
as was suggested by Daniel.
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
