LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-06-2010, 01:00 AM   #1
slashmais
LQ Newbie
 
Registered: Mar 2007
Posts: 9

Rep: Reputation: 0
How to programmatically monitor/intercept all network comms on my PC


I want to write a program that intercepts in real-time all network comms of whatever protocol that goes through eth0 (in and out) on my box. What do I need to take into account and where can I get necessary info? Pointers to samples & algorithms would be most welcome. There must be a standard way to access/use eth0, but I can't find/(ask wrong question) with google.
 
Old 12-06-2010, 04:31 AM   #2
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,576
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
You could look at the Wireshark source code.
 
Old 12-06-2010, 04:52 AM   #3
gd2shoe
Member
 
Registered: Jun 2004
Location: Northern CA
Distribution: Debian
Posts: 835

Rep: Reputation: 49
Welcome to LQ.

There is a way to do it. Wireshark does, though I don't know how. If Wireshark doesn't do what you need, then you could check its source. (I know. It's a pain, but it is a place to start. Squid's transparent proxy might also be a relevant source sample.)

You may be able to do something spiffy using iptables. I heard once that it could be tapped into somehow, but I don't see the rule off-hand. It might not be useful, but I thought I'd mention it.

Monitoring all interface traffic isn't something frequently done. The people who can provide good answers are probably not checking the Newbie forum. You might get a better response from the Networking or Programming forums. (Don't start a duplicate thread. Click "Report" and ask them to move it.)
 
Old 12-06-2010, 04:53 AM   #4
gd2shoe
Member
 
Registered: Jun 2004
Location: Northern CA
Distribution: Debian
Posts: 835

Rep: Reputation: 49
Dang it. I got beat to the punch while trying to find a better answer!
 
Old 12-06-2010, 06:55 AM   #5
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,576
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
Quote:
Originally Posted by gd2shoe View Post
Dang it. I got beat to the punch while trying to find a better answer!
Ain't that just always the way! but you suggested some other options too.
 
Old 12-06-2010, 08:48 PM   #6
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.8, Centos 5.10
Posts: 17,241

Rep: Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325
iptables has a LOG option. Depends if you want to go any lower (more detail), in which case Wireshark (tcpdump) as above.
Note that you can rapidly fill your disk with data doing this...
 
Old 12-07-2010, 02:36 AM   #7
slashmais
LQ Newbie
 
Registered: Mar 2007
Posts: 9

Original Poster
Rep: Reputation: 0
Thanks for the pointers ..

Quote:
Originally Posted by chrism01 View Post
iptables has a LOG option. Depends if you want to go any lower (more detail), in which case Wireshark (tcpdump) as above.
Note that you can rapidly fill your disk with data doing this...
I once used the mysql facility to log all SQL calls it executes & forgot to remove it after solving the problem - it was on a production box, it was also an interesting experience..
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to programmatically determine monitor type markseger Linux - Software 2 07-07-2010 02:32 PM
How To Programmatically Extract Monitor Name Woodsman Slackware 8 09-10-2009 08:04 PM
how to programmatically monitor a process memory usage? thanhvn Programming 14 02-20-2009 02:15 AM
how to programmatically monitor a process memory usage? thanhvn Linux - Software 1 11-15-2005 09:44 PM
programmatically wake up monitor dovkruger Programming 1 11-03-2005 05:27 PM


All times are GMT -5. The time now is 12:14 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration