Hi,
we just added a few applications to the netmap distribution on github.
NMREPLAY is a netmap based traffic generator that can read a pcap file
and play it back at a programmable rate. The code is partly based on
TLEM (previously announced), and same as the latter can reach 20 Mpps
and 40-50
Hello everybody,
I'm about writing a packet filter using libpcap .. I just have two
theoretical question that I hope to get them answered here.
1)
Let say, I've initialed pcap on my ethernet nic using "pcap_open_live"
(in non-blocking-mode) and "pcap_dispatch". lets
Hi.
It appears the when I send a frame with pcap_inject, and then do a pcap_next, I
get back the same frame I just sent. Is there a way to turn this off?
There is a BIOCFEEDBACK ioctl on the underlying bpf fd but that does not appear
to have any effect.
The reason I don't want this behaviour i
Folks,
I've working on a libpcap-based program that sends packets over a
gogoc-created tunnel. The gogoc-created interface is of type DLT_NULL.
My understanding is that packets sent/received on such interface type
include a 4-byte header that includes the address family as a 32-bit
integer, in ho
with read/recvfrom so we'v made that with libpcap. It
coul be done with directly bpf api without pcap wrapper but i'm not sure about
how big pcap overhead is.
The questions is if we have about 1Gb incoming traffic and using pcap filter
for specific port how big is impact of using pc
with read/recvfrom so we'v made that with libpcap. It
> coul be done with directly bpf api without pcap wrapper but i'm not sure
> about how big pcap overhead is.
>
> The questions is if we have about 1Gb incoming traffic and using pcap filter
> for specific port how big is
f api without pcap wrapper but
i'm not sure about how big pcap overhead is.
The questions is if we have about 1Gb incoming traffic and using pcap
filter for specific port how big is impact of using pcap in such
situation? Is it possbile to estimate? Target traffic is about 1Mbit and
whi
On Wed, Mar 02, 2011 at 04:57:18PM -0600, Brandon Gooch wrote:
> On Wed, Mar 2, 2011 at 3:52 PM, Wesley Shields wrote:
> > On Wed, Mar 02, 2011 at 07:45:40PM +, Bruce Cran wrote:
> >> On Wed, 2 Mar 2011 13:40:57 -0600
> >> Brandon Gooch wrote:
> >>
> >> > BTW, if you give your devices descrip
On Wed, Mar 02, 2011 at 04:57:18PM -0600, Brandon Gooch wrote:
> On Wed, Mar 2, 2011 at 3:52 PM, Wesley Shields wrote:
> > On Wed, Mar 02, 2011 at 07:45:40PM +, Bruce Cran wrote:
> >> On Wed, 2 Mar 2011 13:40:57 -0600
> >> Brandon Gooch wrote:
> >>
> >> > BTW, if you give your devices descrip
On Wed, Mar 2, 2011 at 3:52 PM, Wesley Shields wrote:
> On Wed, Mar 02, 2011 at 07:45:40PM +, Bruce Cran wrote:
>> On Wed, 2 Mar 2011 13:40:57 -0600
>> Brandon Gooch wrote:
>>
>> > BTW, if you give your devices descriptions, libpcap
>> > starts to behave again; this could be a clue to the sou
On Wed, Mar 02, 2011 at 07:45:40PM +, Bruce Cran wrote:
> On Wed, 2 Mar 2011 13:40:57 -0600
> Brandon Gooch wrote:
>
> > BTW, if you give your devices descriptions, libpcap
> > starts to behave again; this could be a clue to the source of the bug
> > :/
>
> 0xa5 is the malloc fill pattern wh
On Wed, 2 Mar 2011 13:40:57 -0600
Brandon Gooch wrote:
> BTW, if you give your devices descriptions, libpcap
> starts to behave again; this could be a clue to the source of the bug
> :/
0xa5 is the malloc fill pattern when debugging is enabled, and
having recently reinstalled FreeBSD I forgot to
On Tue, Mar 1, 2011 at 12:37 AM, Bruce Cran wrote:
> I installed wireshark on my 9-CURRENT machine yesterday and found that
> the interface description fields are all set to 0xa5. From reading the
> code it looks like the data is being fetched via pcap.
>
> Device: usbus1
> Des
I installed wireshark on my 9-CURRENT machine yesterday and found that
the interface description fields are all set to 0xa5. From reading the
code it looks like the data is being fetched via pcap.
Device: usbus1
Description: \xa5\xa5\xa5\xa5\xa5\xa5\xa5\xa5\xa5\xa5\xa5\xa5\xa5\xa5
\xa5\xa5\xa5
Hi.
I have a trouble that an application packet-injecting by pcap(bpf)'s
pcap_sendpacket function doesn't communicate to FreeBSD host, but
can communicate to other machine. So I researched, and I noticed
that sys/net/if_ethersubr.c has a structured
Hmmm. A mail from you, but no OIDs there. Maybe I stuck it somewhere
else...
SS>> I probably missed something here. Any other conflicts? Can we move
bsnmp-pcap
SS>> to 207? And does bsnmp-jails conflict with something?
SS>>
SS>
SS>begemot.205 BRIDGE
SS>begemot.206 VLAN
Ok.
Harti Brandt wrote:
> I probably missed something here. Any other conflicts? Can we move bsnmp-pcap
> to 207? And does bsnmp-jails conflict with something?
Like Shteryana said, it seems like it does conflict...
Would it work to have and 1112? I used those while the software
Harti Brandt wrote:
> I probably missed something here. Any other conflicts? Can we move bsnmp-pcap
> to 207? And does bsnmp-jails conflict with something?
Like Shteryana said, it seems like it does conflict...
Would it work to have and 1112? I used those while the software
exData bsnmp-regex (Nate Nielsen
> )
> 204 pingDatabsnmp-ping (Nate Nielsen
> )
> 205 bsnmp-jails per jail networking, cpu, disk, memory
> statistics
> 206 bsnmp-pcap monitor tra
205 bsnmp-jails per jail networking, cpu, disk, memory
statistics
206 bsnmp-pcap monitor traffic for specific network
flows
300 BEGEMOT-ACM DLR ACM project
405 mysql (vani...@fatpipi.com)
406
t { begemot 206 } is already allocated
for begemotVlan - and the two modules will conflict - you might want
to contact harti for a free OID under begemot.
cheers,
Shteryana
> FreeBSD port attached, more info here:
>
> http://memberwebs.com/stef/software/bsnmp-pcap
Figured this may be interesting for folks...
I've released a bsnmp module which can monitor arbitrary traffic flows
and expose them as SNMP counters.
FreeBSD port attached, more info here:
http://memberwebs.com/stef/software/bsnmp-pcap/
Cheers,
Stef W
Le 19 sept. 07 à 16:59, Fabien THOMAS a écrit :
Result of pcap benchmark requested by Vlad Galu:
Using polling is better.
Test setup:
---
netblast -- em|fxp -- pcap_bmark
under FreeBSD 6.2
Small product (fxp interface):
---
pollng:
Captured
Result of pcap benchmark requested by Vlad Galu:
Using polling is better.
Test setup:
---
netblast -- em|fxp -- pcap_bmark
under FreeBSD 6.2
Small product (fxp interface):
---
pollng:
Captured 30322.00 pps (total of 333542) and dropped 144
Since it seems that tcpdump people are more or less gone, is it still
too much to ask
that the broken code in src/contrib/libpcap/pcap-bpf.c starting from
line 236
which breaks the bufsize would be removed from the FreeBSD repository?
Obviously the option is to fix the code but that´s much more
Dear Lists
1.I want to know if there is any snoop TCP Source Code for 4.4FreeBSD?
2.Tell me if pcap-snoop.c is the snoop-tcp tool.
3.Tell me if there is any support for packetshell on FreeBSD.
THANX
_
Protect your PC - get
Hi
Have You any sample ?
and i want to know how the packet is writen on pcap buffer and how they will
forward ? if they are forwarded after the saving or they will never be
forwarded ?
i mean that is this scenario true ? or not
packet > ip_input -copy of packet---> wri
Hi
can i use pcap to access all of the packets travel through my gateway
THANX
_
Help STOP SPAM with the new MSN 8 and get 2 months FREE*
http://join.msn.com/?page=features/junkmail
To Unsubscribe: send mail to [EMAIL PROTECTED
Hi,
--- Petri Helenius <[EMAIL PROTECTED]> wrote:
> (I'm sending a copy here since I'm running this on FreeBSD and got
> no reply so far from the tcpdump folks)
>
> Function pcap_open_live in pcap-bpf.c contains the code snippet below.
>
> To me, this doe
> 32k is already a bump up from the default of 4k, which at the time that
> was set (and hard coded) probably seemed "good enough". Obviously as
> interfaces have gotten faster, that number has become out of date. Yes
> they SHOULD make it pcap-user tunable, the comment e
On Sat, Sep 21, 2002 at 12:03:30PM +0300, Petri Helenius wrote:
> (I'm sending a copy here since I'm running this on FreeBSD and got
> no reply so far from the tcpdump folks)
>
> Function pcap_open_live in pcap-bpf.c contains the code snippet below.
>
> To me,
(I'm sending a copy here since I'm running this on FreeBSD and got
no reply so far from the tcpdump folks)
Function pcap_open_live in pcap-bpf.c contains the code snippet below.
To me, this does not make too much sense, because:
- if v is too big to be accommodated (either by config
32 matches
Mail list logo
