pushing the packets back to kernel queue

chakka.lokesh · 02-03-2016, 03:25 AM

I am using raw Ethernet sockets to capture the packets from receive queue.
Socket call I am using is :

Code:

socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));

After capturing, I will do some calculations and depending on the result either I wish to drop or push back to kernel stack.

Could someone help me telling how to send the packet back to kernel for normal processing ?

NevemTeve · 02-03-2016, 04:56 AM

You don't have to 'push back the packets to kernel queue' because you have never removed them from there. You only got a copy of the packages.

sundialsvcs · 02-05-2016, 07:02 AM

. . . but you also must be prepared to take steps to ensure that you do not examine the same packet(s) more than once, thereby invalidating your statistics . . .

chakka.lokesh · 02-07-2016, 11:50 PM

my code is like this:

while(1)
{
read();
calculate statistics;
}

in this way, i hope i won't be doing the calculations for same packet twice.

chakka.lokesh · 02-24-2016, 09:08 PM

Quote:

Originally Posted by NevemTeve

You don't have to 'push back the packets to kernel queue' because you have never removed them from there. You only got a copy of the packages.

If so why "System Monitor" is showing zero traffic even if I am sending/receiving packets ?

In case my statistics result gives me TRUE, is there a way to remove the packet from the kernel space or make kernel discard that packet so that further processing won't happen or other applications won't receive those packets ?

Is there a way I get the handler of the packet directly instead of copy of the packet ?

My objective is to reduce the load on the kernel/hardware.

NevemTeve · 02-24-2016, 10:38 PM

Carefully read the documentation of ipfwadm/ipchains/iptables/nftables/whateveritisnow