Ethernet Sniffer Kernel-Modul

PrincessPeach · 03-14-2017, 09:22 AM

Hello,

i want receive ethernet data packets. I'm using a FPGA which sends to my PC much data via UDP to two Ethernetports.

Now i can receive on one ethernetport the data correct, but on all other ethernetports i get bad data.

I was searching for anything to tell my kernel modul to use NOT the first Ethernetport, but i get only the data from the first Port. In this example i tested to shift the skb with next. But it doesn't matter. I get only the Payload from the first port or it isn't allocate correct. But if I use the first Port it will be doing fine.

The Problem is i want to use my Server-Ethernetcard which has more performance to receive my data in high speed. This project is for an real-time display of some measurementdata.

Code:

#include <linux/module.h> // included for all kernel modules
#include <linux/kernel.h> // included for KERN_INFO
#include <linux/init.h> // included for __init and __exit macros
#include <linux/skbuff.h> // included for struct sk_buff
#include <linux/if_packet.h> // include for packet info
#include <linux/ip.h> // include for ip_hdr 
#include <linux/netdevice.h> // include for dev_add/remove_pack
#include <linux/if_ether.h> // include for ETH_P_ALL

#include "Header.h"


MODULE_LICENSE("GPL");


struct packet_type my_proto;

int my_packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
{
	printk(KERN_ERR "+1!\n");
	
	switch(skb->pkt_type)
	{
		case PACKET_HOST:
			printk("Packet Host\n");
			break;

		case PACKET_BROADCAST:
			printk("Broadcast\n");
			break;
		
		case PACKET_MULTICAST:
			break;

		case PACKET_OTHERHOST:
			break;

		case PACKET_OUTGOING:
			break;

		case PACKET_LOOPBACK:
			break;

		case PACKET_FASTROUTE:
			break;
	}

	printk("============================================\n");
	printk("============================================\n");
	printk("Nr 0\n");
printk("%s 0x%.4X 0x%.4X \n", skb->dev->name, ntohs(skb->protocol), ip_hdr(skb)->protocol);

	PrintData(skb->data, skb->len);
	skb = skb->next;
	
	printk("============================================\n");
	printk("Nr 1\n");
printk("%s 0x%.4X 0x%.4X \n", skb->dev->name, ntohs(skb->protocol), ip_hdr(skb)->protocol);

	PrintData(skb->data, skb->len);
	skb->next;
	
	printk("============================================\n");
	printk("Nr 2\n");
printk("%s 0x%.4X 0x%.4X \n", skb->dev->name, ntohs(skb->protocol), ip_hdr(skb)->protocol);

	PrintData(skb->data, skb->len);

	printk("============================================\n");
	printk("Nr 3\n");
printk("%s 0x%.4X 0x%.4X \n", skb->dev->name, ntohs(skb->protocol), ip_hdr(skb)->protocol);

	PrintData(skb->data, skb->len);
	skb->next;

	printk("============================================\n");
	printk("Nr 4\n");
printk("%s 0x%.4X 0x%.4X \n", skb->dev->name, ntohs(skb->protocol), ip_hdr(skb)->protocol);

	PrintData(skb->data, skb->len);
	skb->next;

	printk("============================================\n");
	printk("Nr 5\n");
printk("%s 0x%.4X 0x%.4X \n", skb->dev->name, ntohs(skb->protocol), ip_hdr(skb)->protocol);

	PrintData(skb->data, skb->len);
	
	printk("============================================\n");
	printk("Nr 6\n");printk("%s 0x%.4X 0x%.4X \n", skb->dev->name, ntohs(skb->protocol), ip_hdr(skb)->protocol);
	PrintData(skb->data, skb->len);



printk("%s 0x%.4X 0x%.4X \n", skb->dev->name, ntohs(skb->protocol), ip_hdr(skb)->protocol);


	printk("%x\n", skb->data);
	kfree_skb(skb);
	return 0;
}






static int __init net_init(void)
{
	printk("Hallo Welt\n");

	my_proto.type = htons(ETH_P_ALL);
	my_proto.dev = NULL;
	my_proto.func = my_packet_rcv;

	dev_add_pack(&my_proto);
	return 0;
}

static void __exit net_exit(void)
{
	dev_remove_pack(&my_proto);
	printk("Bye, grauenhafte Welt\n");
}


module_init(net_init);
module_exit(net_exit);

PrincessPeach · 03-15-2017, 09:58 AM

A little Update.

I can receive Packets with a maximum payload of 250 mB. My measurement Packets have a size of 1500 mB. But the great packets i can only receive on the first Ethernet-Device. My Server-Card do not receive the bigger datapackets. (Ethernet Server Adapter I350-T4)