LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software > Linux - Kernel
User Name
Password
Linux - Kernel This forum is for all discussion relating to the Linux kernel.

Notices

Reply
 
LinkBack Search this Thread
Old 09-17-2009, 12:29 AM   #1
yaplej
Member
 
Registered: Apr 2009
Distribution: CentOS, Ubuntu, openSuSE
Posts: 139
Blog Entries: 1

Rep: Reputation: 22
printk incorrect output from ntohs(tcp_hdr(skb)->source)


I am messing around with linux kernel modules while I learn C. I wrote a LKM that has sucessfully been sniffing IP Packets Source/Destination, and writing that to /var/log/messages with printk, but when I try to access the TCP header source/dest, and write it to the log I am not getting the correct values.

The dest should be 80(http), but the log is saying 40. Is there some other conversion of "tcp_hdr(skb)->dest" I need to do for it to print the correct value? I know the value should be 80 so I expect that the source value I am getting is also incorrect, but have not used Wireshark to deteremine that its actual value is.

Code:
printk(KERN_ALERT "Source: %d.%d.%d.%d:%d. Destination: %d.%d.%d.%d:%d\n", NIPQUAD(ip_hdr(skb)->saddr), ntohs(tcp_hdr(skb)->source), NIPQUAD(ip_hdr(skb)->daddr), ntohs(tcp_hdr(skb)->dest));
Thanks.
 
Old 09-17-2009, 03:31 PM   #2
yaplej
Member
 
Registered: Apr 2009
Distribution: CentOS, Ubuntu, openSuSE
Posts: 139
Blog Entries: 1

Original Poster
Rep: Reputation: 22
Need to pull the tcp header to read the tcp ports.

Code:
struct tcphdr *tcph;
struct iphdr *iph;

iph = ip_hdr(skb);
tcph = (struct tcphdr *)(skb->data + (iph->ihl << 2 ));

printk(KERN_ALERT "Source: %d.%d.%d.%d:%d. Destination:%d.%d.%d.%d:%d\n", NIPQUAD(iph->saddr), ntohs(tcph->source),
NIPQUAD(iph->daddr), ntohs(tcph->dest));
 
Old 05-26-2010, 02:38 AM   #3
kinder
LQ Newbie
 
Registered: May 2010
Posts: 1

Rep: Reputation: 0
Angry

Hello !!

I tried to run this module but i got the following error

‘skb’ undeclared (first use in this function)"


Then i added the following ...

const struct sk_buff *skb;

I got the warnings ..

warning: unused variable ‘iph’
warning: ‘skb’ is used uninitialized in this function


Please help me out !!
I want print the IP header information.....
 
Old 05-28-2010, 09:14 PM   #4
yaplej
Member
 
Registered: Apr 2009
Distribution: CentOS, Ubuntu, openSuSE
Posts: 139
Blog Entries: 1

Original Poster
Rep: Reputation: 22
You have to use this code from a netfilter hook. I made a post about using netfilter hooks in my blog on this site.
 
Old 06-29-2012, 06:55 PM   #5
dhavey
LQ Newbie
 
Registered: Jun 2012
Posts: 9

Rep: Reputation: Disabled
It's the same ;^)

Hehe ;^) Nice code, but...
Looks like it does the same thing to me. Doesn't tcp_hdr(skb) also pull data from the skb?

Anyways that's the results I'm getting.

Just FYI (I know the thread is old, but, still ;^)
I'm working in the sch_red.ko module. On the host PC tcp_hdr(skb) works as expected. On the router it always seems to generate the same (wrong) source and dest port. Your neat little piece of code does the same thing.

I suspect that my router is doing something funny ;^)

...Daniel
 
Old 06-29-2012, 07:12 PM   #6
yaplej
Member
 
Registered: Apr 2009
Distribution: CentOS, Ubuntu, openSuSE
Posts: 139
Blog Entries: 1

Original Poster
Rep: Reputation: 22
Yes,

tcp_hdr(skb) should pull the correct data but the linux kernel I was using at the time it would not work. All my development was with CentOS 5 being based on RHEL its a little behind when it comes to the latest linux kernel.

I have a full example of using netfilter hooks but it was for an older kernel so might not work now.
http://opennop.svn.sourceforge.net/v...lpha%200.2.56/

Here is a much simpler kernel driver that I think works with newer kernels. At least the latest kernel used by openSuse & RHEL.
http://opennop.svn.sourceforge.net/v.../module/trunk/

You can see I am still using my original method in the userspace daemon to map the pointer to the correct tcp_header. I could probably try using the simpler tcp_hdr(skb) and see if it works.
http://opennop.svn.sourceforge.net/v...73&view=markup

Justin.
 
Old 07-13-2012, 01:50 PM   #7
dhavey
LQ Newbie
 
Registered: Jun 2012
Posts: 9

Rep: Reputation: Disabled
Wink

Hi Justin,

Netfilter hook blog? Could you shoot me a link to that? For a networking scientist I know embarrassingly little about netfilter hooks and the proper way of doing things in the kernel. I just sort of found the kernel code and started messing around with it's brains. It might be worthwhile for me to learn how everybody else does things ;^)

...Daniel

Last edited by dhavey; 07-13-2012 at 01:57 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Where is printk output? zali Programming 11 08-02-2009 02:23 PM
How to capture output of system call that uses printk? Ook Linux - Newbie 1 04-23-2008 11:22 PM
Can't get printk output directed to console xuanadoo Linux - Newbie 0 11-07-2006 08:40 PM
group the outgoing skb's into single skb and then send grouped skb. venkatesh111 Linux - Networking 0 04-27-2006 01:05 AM
output of printk can NOT be found in /var/log/messages linshu Linux - Software 1 02-13-2004 09:06 AM


All times are GMT -5. The time now is 11:24 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration