pushing the packets back to kernel queue
I am using raw Ethernet sockets to capture the packets from receive queue.
Socket call I am using is : Code:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); Could someone help me telling how to send the packet back to kernel for normal processing ? |
You don't have to 'push back the packets to kernel queue' because you have never removed them from there. You only got a copy of the packages.
|
. . . but you also must be prepared to take steps to ensure that you do not examine the same packet(s) more than once, thereby invalidating your statistics . . .
|
my code is like this:
while(1) { read(); calculate statistics; } in this way, i hope i won't be doing the calculations for same packet twice. |
Quote:
In case my statistics result gives me TRUE, is there a way to remove the packet from the kernel space or make kernel discard that packet so that further processing won't happen or other applications won't receive those packets ? Is there a way I get the handler of the packet directly instead of copy of the packet ? My objective is to reduce the load on the kernel/hardware. |
Carefully read the documentation of ipfwadm/ipchains/iptables/nftables/whateveritisnow
|
All times are GMT -5. The time now is 09:51 PM. |