On Sun, 7 Sep 2003, Lev Walkin wrote:
LW> > [all below is for 4-STABLE]
LW> >
LW> > I'm trying to write effective arp scanner for multi-interface router (esp.
LW> > multi-vlan); I plan to use multiple bpf devices attached to different
LW> > interfaces emitting ARP requests and filters listening to ARP replies; the most
LW> > natural way to multiplex them for me is select().
LW> >
LW> > However, my tests show that select()ing bpf fd does not lead to trigger packets
LW> > available to bpf filter; the process hangs in select state while parallel
LW> > tcpdump process shows packets desired *and* is in bpf state.
LW> >
LW> > Am I missing something "base"? References (surely, I'd already read
LW> > manpages for bpf, pcap and related -- but did I still missed something
LW> > serious?) would be greatly appreciated.
LW>
LW> Yes, you're missing the interactive mode.
LW> Refer to BIOCIMMEDIATE in the bpf(4) manual page.
Unfortunately not ;-)
My test program chich I suppose should catch any ARP packets around
attached.
Sincerely,
D.Marck [DM5020, MCK-RIPE, DM3-RIPN]
------------------------------------------------------------------------
*** Dmitry Morozovsky --- D.Marck --- Wild Woozle --- [EMAIL PROTECTED] ***
------------------------------------------------------------------------
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <net/bpf.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <net/ethernet.h>
#include <netinet/in.h>
#include <netinet/if_ether.h>
#include <err.h>
#include <fcntl.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>
/* bpf FSM to filter only ARP requests */
/*
struct bpf_insn insns[] = {
BPF_STMT(BPF_LD+BPF_H+BPF_ABS, ETHER_ADDR_LEN*2),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_ARP, 0, 3),
BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARPOP_REQUEST, 0, 1),
BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) +
sizeof(struct ether_header)),
BPF_STMT(BPF_RET+BPF_K, 0),
};*/
struct bpf_insn insns[] = {
BPF_STMT(BPF_LD+BPF_H+BPF_ABS, ETHER_ADDR_LEN*2),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_ARP, 0, 1),
BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) +
sizeof(struct ether_header)),
BPF_STMT(BPF_RET+BPF_K, 0),
};
struct bpf_program bpf_arpreply = {
sizeof(insns) / sizeof(struct bpf_insn),
insns
};
#define BUFSZ 4096
static char buf[BUFSZ];
int main(int argc, char *argv[])
{
int fd, sz;
u_int yes;
char *bpfn, *ifname;
fd_set fds;
struct ifreq ifr;
bpfn = "/dev/bpf1";
ifname = "rl0";
if ((fd = open(bpfn, O_RDWR)) == -1)
err(1, "can't open %s", bpfn);
strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
if (ioctl(fd, BIOCSETIF, &ifr) == -1)
err(1, "can't attach to %s", ifname);
if (ioctl(fd, BIOCSETF, &bpf_arpreply) == -1)
err(1, "can't set ARP reply filter");
if (ioctl(fd, BIOCPROMISC, NULL) == -1)
err(1, "can't set promisc mode");
if (ioctl(fd, BIOCIMMEDIATE, &yes) == -1)
err(1, "can't set IMMEDIATE mode");
FD_ZERO(&fds);
FD_SET(fd, &fds);
while (select(1, &fds, NULL, NULL, NULL) != -1) {
/* FD_ISSET(fd, fds) is always 1 here */
printf("we have packet to read!");
sz = read(fd, buf, BUFSZ);
printf(" its len is %d bytes!\n", sz);
}
close(fd);
return 0;
}
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
