Which kernel structure has ip address and socket information

dlevy022 · 12-27-2016, 05:28 PM

I know the task_struct is a linked list that contains information about the processes running on a linux system but what I am looking for is a similar structure that has ip address and socket information or ip address and mac address information. I've been looking through kernel code and can't seem to find the "main" structure that has ip network information. Also, I should note that I am approaching this from a memory forensics point of view so once I know the structure I can locate its offset and extract data from it. Thanks for any help

cliffordw · 12-28-2016, 10:12 AM

Hi,

I'm afraid I don't know the answer to your question. It might be worthwhile looking at the source code for tools like "netstat" and "lsof" that display this information, to see where they find it.

Good luck!

patrick295767 · 01-05-2017, 11:48 AM

Here a part of my alternative programm for http access, below which can orientate you.

Code:

  1436 #include <unistd.h>
  1438 #include <sys/types.h>
  1439 #include <sys/socket.h>  // <-- not there for windows
  1440 #include <sys/ioctl.h>
  1441 #include <netinet/in.h>
  1442 #include <net/if.h>
  1443 #include <arpa/inet.h>

linswap · 03-10-2017, 04:57 AM

In Linux kernel, all network-related queues and buffers uses a common data structure 'struct sk_buff' and 'struct net_device' for the device structure.