LinuxQuestions.org - Need help with intercepting and forwarding UDP packets

- Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)

- - Need help with intercepting and forwarding UDP packets (https://www.linuxquestions.org/questions/linux-networking-3/need-help-with-intercepting-and-forwarding-udp-packets-802491/)

Need help with intercepting and forwarding UDP packets

Hi everybody,

I have a legacy application that communicates status to a remote server over UDP. The server app replies back to the client with UDP as well, using the IP address it obtains from the sockaddr parameter of the recvfrom() method.

Code:

[----------------]                      [----------------]  

[ client <->(udp)]<----- Ethernet -----> [(udp)<-> server ]

[----------------]                      [----------------]

I'm trying to replace the underlying use of ethernet, with a RS232 based radio/modem device - WITHOUT making any src changes to the legacy apps. Ie. apps would still create and transmit UDP packets addressed to a remote IP address and listening port, and the receiver wouldn't know any difference.

I'm relatively new to this level of network programming, but my first attempt has been to write an app that sniffs out outbound raw UDP packets (using pcap), transmit that data over the radio, and re-injects the UDP unchanged on the remote end.

Code:

[----------------]                      [----------------]  

[ client <->(udp)]                      [(udp)<-> server ]

[            |  ]                      [  ^            ]

[            v  ]                      [  |            ]        

[      /capture/]<---- Radio XMIT ----> [/reinject/      ]

[----------------]                      [----------------]

My 'capture' app intercepts the UDP packets just fine when the machine is 'plugged' in, but as soon as I disconnect my network cable to test wireless, outbound packets addressed to a remote IP (ie. the server) are no longer captured (tho local UDP packets are picked up ok).

Wireshark also does not report the original outbound packet, but it does show an ICMP packet reporting 'Host Unreachable'. I understand the host isn't reachable, but I'm confused as to why the packet isn't at least making it to the interface/network card.

Is there anyway to get the force the kernel to 'transmit' the UDP packet anyway so that my capture app can intercept it? or is there a better/easier solution (again, w/o making source changes to the client/server)?

thanks in advance!!!

You should be using the tun interface, not pcap. However if the radio link is transparent to RS232 you could PPP or SLIP without having to do any programming.

As for why the packet doesn't reach the network interface, that would be pointless and the Ethernet address is unknown as the remote system isn't responding to ARP.

Hi Timothy! thank you so much for responding!

Quote:

Originally Posted by TimothyEBaldwin (Post 3939126)

You should be using the tun interface, not pcap. However if the radio link is transparent to RS232 you could PPP or SLIP without having to do any programming.

the radio that i'm using does have a transparent serial mode, but i'm using it in MESH mode which requires framed data.

BUT... i just did some quick research on tun/tap interfaces and it does sound like a great fit for what i'm trying to do!

Q1 : does a TUN interface only work point-to-point (ie. pure tunnel)... and does that mean i'll need to use a TAP interface to get point-2-multipoint with IP addressing capability?

Q2 : if i need to use TAP, do i have to create my own ARP packets to provide the ethernet header info to the sender or does all that work like 'magic' once all the virtual interfaces are setup?

Q3 : if i can get by with TUN, do i need to wrap the IP packet with a bogus ethernet header before writing it to the virtual TUN interface on the receiver side? or will with kernel just bypass the ethernet layer if the ethernet headers aren't present and deliver the UDP packet normally?

THANKS again for your help! very much appreciated!!!

A1: If you use TUN for multipoint you must handle the IP address, which can be complicate, especially if there are multiple routers connected to the radio network.

A2: If you use TAP and don't transport ARP, which requires broadcast, you must create ARP packets (or otherwise add entries to the ARP table), but unlike TUN you get the next-hop IP address so that you need not worry about implementing a route table lookup.

A3: For TUN you must not add an Ethernet header.

TAP is probably simpler.

thanks Timothy. I've got the capture (and rf transport) part working good now, however, my reinjected packets are NOT being received on the destination machine by the UDP server. I am using a tap interface so that I can pass both ARP and UDP (and eventually everything else) over the modem. Am i correct in thinking that if i simply 'write()' the original ethernet frame data to the tap interface on the server machine, that the kernel should deliver it to a server listening on the correct port?

here's a thread that i created in the Programming forum that has the details of where i'm stuck now : http://www.linuxquestions.org/questi...errerid=522411

thanks for any insight you can offer, i'm really struggling with why this isn't working.

keith