LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Programming (https://www.linuxquestions.org/questions/programming-9/)
-   -   pushing the packets back to kernel queue (https://www.linuxquestions.org/questions/programming-9/pushing-the-packets-back-to-kernel-queue-4175570296/)

chakka.lokesh 02-03-2016 03:25 AM

pushing the packets back to kernel queue
 
I am using raw Ethernet sockets to capture the packets from receive queue.
Socket call I am using is :

Code:

socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
After capturing, I will do some calculations and depending on the result either I wish to drop or push back to kernel stack.

Could someone help me telling how to send the packet back to kernel for normal processing ?

NevemTeve 02-03-2016 04:56 AM

You don't have to 'push back the packets to kernel queue' because you have never removed them from there. You only got a copy of the packages.

sundialsvcs 02-05-2016 07:02 AM

. . . but you also must be prepared to take steps to ensure that you do not examine the same packet(s) more than once, thereby invalidating your statistics . . .

chakka.lokesh 02-07-2016 11:50 PM

my code is like this:

while(1)
{
read();
calculate statistics;
}

in this way, i hope i won't be doing the calculations for same packet twice.

chakka.lokesh 02-24-2016 09:08 PM

Quote:

Originally Posted by NevemTeve (Post 5493593)
You don't have to 'push back the packets to kernel queue' because you have never removed them from there. You only got a copy of the packages.

If so why "System Monitor" is showing zero traffic even if I am sending/receiving packets ?

In case my statistics result gives me TRUE, is there a way to remove the packet from the kernel space or make kernel discard that packet so that further processing won't happen or other applications won't receive those packets ?

Is there a way I get the handler of the packet directly instead of copy of the packet ?

My objective is to reduce the load on the kernel/hardware.

NevemTeve 02-24-2016 10:38 PM

Carefully read the documentation of ipfwadm/ipchains/iptables/nftables/whateveritisnow


All times are GMT -5. The time now is 09:51 PM.