LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 01-05-2007, 04:16 AM   #1
Peter John
LQ Newbie
 
Registered: Jan 2007
Posts: 29

Rep: Reputation: 15
Capturing Layer 3 Traffic


How can we capture Layer 3 traffic on to our application / driver

Thanks
Peter
 
Old 01-05-2007, 09:40 PM   #2
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 335Reputation: 335Reputation: 335Reputation: 335
I assume you are refering to network traffic. The tcpdump command will let you capture any portion of each packet that pass filtering, including all the data.
 
Old 01-06-2007, 03:05 AM   #3
Peter John
LQ Newbie
 
Registered: Jan 2007
Posts: 29

Original Poster
Rep: Reputation: 15
Smile Capturing Layer 3 Traffic

I want to be in b/n layer3 and layer2 and capture it when kernel sends packets to layer 2.

Peter John
 
Old 01-07-2007, 05:22 AM   #4
Peter John
LQ Newbie
 
Registered: Jan 2007
Posts: 29

Original Poster
Rep: Reputation: 15
Capturing Layer 3 Traffic

Between IP and Ethernet Layer in the kernel.

Can this be done ???

Peter
 
Old 01-07-2007, 06:17 AM   #5
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Quote:
Originally Posted by Peter John
Between IP and Ethernet Layer in the kernel.

Can this be done ???

Peter
Sure. Checkout the kernel source and edit the TCP/IP stack to include your capturing code, then recompile...

The BPF (which is what all the other "sniffers" are built on top of) will let you observe packets on the wire, but it's not actually tracing the different operations happening in the kernel and giving you a blow-by-blow report. If you want to be in the kernel, you're going to have to write a "shim" that sits in the stack itself.
 
Old 01-08-2007, 12:10 AM   #6
Peter John
LQ Newbie
 
Registered: Jan 2007
Posts: 29

Original Poster
Rep: Reputation: 15
Embed an Bluetooth Stack

Our Company has its own BT Stack. We want to integrate it with Linux and check "TCP/IP Over BT" functionality. i.e Layer 2 and Layer1 as our BT stack, which is functional on linux. Is there any way we can do it without kernel recompile ?
 
Old 01-08-2007, 12:12 AM   #7
Peter John
LQ Newbie
 
Registered: Jan 2007
Posts: 29

Original Poster
Rep: Reputation: 15
Embed an Bluetooth Stack

We have our own BT Stack. We want to integrate it with Linux and check "TCP/IP Over BT" functionality. i.e Layer 2 and Layer1 as our BT stack, which is functional on linux. Is there any way we can do it without kernel recompile ?
 
Old 01-08-2007, 12:27 AM   #8
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
So you have a working implementation of Bluetooth for Linux and want to transport TCP/IP over it? Do you just need to watch the packets on the wire to make sure there are no anomalies, or do you need something more intrusive than that? If it's more than just observing wire traffic (well, a virtual "wire" in this case) then you're probably better off posting in either the Programming or Linux Software -> Kernel forums.

Although it's out of my realm of expertise, I doubt it's possible to achive without recompiling the kernel... Maybe it's possible to insert as a kernel module...
 
Old 01-08-2007, 12:33 AM   #9
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 335Reputation: 335Reputation: 335Reputation: 335
If you want to integrate into existing kernel space, you can either:

- create you own kernel module. This requires compiling the module itself against the current kernel, a process that must be repeated on each kernel upgrade. This is how many proprietary drivers are implemented. The downside is that you must "taint" the kernel (unless the code is open source under a GPL compatible license), so you become the first line of debugging for all kernel bugs for your customers.

- You can use a facility like SystemTap, if it provides the functionality you need.

- You can simply place the Ethernet interface into permissive mode (as tcpdump does), if that provides the functionality you need.

Failing all of the above, directly modifying the kernel would be need as chort indicated. However, if you are distributing the code outside your company, you are required to return the modifications to the kernel developers under the GPL.
 
Old 01-08-2007, 12:50 AM   #10
Peter John
LQ Newbie
 
Registered: Jan 2007
Posts: 29

Original Poster
Rep: Reputation: 15
We need to implement transporting of TCP/IP over BT Stack.

Peter
 
Old 01-08-2007, 12:54 AM   #11
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 335Reputation: 335Reputation: 335Reputation: 335
TCP/IP over BT is already part of Linux, via BNEP (Bluetooth Network Encapsulation Protocol). Take a looks at this article for an overview.
 
Old 01-08-2007, 02:26 AM   #12
Peter John
LQ Newbie
 
Registered: Jan 2007
Posts: 29

Original Poster
Rep: Reputation: 15
Corrections : Over OUR BT Stack, so how can we make the Kernel to route TCP/IP traffic to our BT Stack

Peter
 
Old 01-08-2007, 05:21 AM   #13
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 57
Make your "BT stack" act as a network driver in terms of interface?
open,stop,start_hard_xmit,..
The current is BNEP, see this:
http://grouper.ieee.org/groups/802/1...tooth/BNEP.pdf

And then... look at the source of bnep?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how to create layer break on dual layer dvd 5matyb5 Linux - General 2 02-28-2011 08:29 PM
DVD Drives - Dual Layer or double layer? Groundhog1248 Linux - Hardware 2 09-23-2009 10:30 PM
Need help with Squid and capturing url traffic? atl02wrx Linux - Software 5 06-25-2005 06:36 PM
Dual Layer ISO onto 2 Single Layer Medias iammike SUSE / openSUSE 3 05-11-2005 06:15 PM
Capturing video with Cinelerra works, capturing video with Xawtv doesn't! seaelf Slackware 0 06-27-2004 06:18 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 07:21 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration