2 * netsniff-ng - the packet sniffing beast
3 * Copyright 2009, 2010 Daniel Borkmann.
4 * Copyright 2014 Tobias Klauser.
5 * Subject to the GPL, version 2.
14 #include <sys/types.h>
15 #include <sys/socket.h>
16 #include <arpa/inet.h>
17 #include <linux/if_ether.h>
25 * tpacket v3 data structures and constants are not available for older kernel
26 * versions which only support tpacket v2, thus we need protect access to them.
29 static inline bool is_tpacket_v3(int sock
)
31 return get_sockopt_tpacket(sock
) == TPACKET_V3
;
34 static inline size_t get_ring_layout_size(struct ring
*ring
, bool v3
)
36 return v3
? sizeof(ring
->layout3
) : sizeof(ring
->layout
);
39 static inline void setup_rx_ring_layout_v3(struct ring
*ring
)
41 /* Pass out, if this will ever change and we do crap on it! */
42 build_bug_on(offsetof(struct tpacket_req
, tp_frame_nr
) !=
43 offsetof(struct tpacket_req3
, tp_frame_nr
) &&
44 sizeof(struct tpacket_req
) !=
45 offsetof(struct tpacket_req3
, tp_retire_blk_tov
));
47 ring
->layout3
.tp_retire_blk_tov
= 100; /* 0: let kernel decide */
48 ring
->layout3
.tp_sizeof_priv
= 0;
49 ring
->layout3
.tp_feature_req_word
= 0;
52 static inline int rx_ring_get_num(struct ring
*ring
, bool v3
)
54 return v3
? ring
->layout3
.tp_block_nr
: ring
->layout
.tp_frame_nr
;
57 static inline size_t rx_ring_get_size(struct ring
*ring
, bool v3
)
59 return v3
? ring
->layout3
.tp_block_size
: ring
->layout
.tp_frame_size
;
62 static int get_rx_net_stats(int sock
, uint64_t *packets
, uint64_t *drops
, bool v3
)
66 struct tpacket_stats k2
;
67 struct tpacket_stats_v3 k3
;
69 socklen_t slen
= v3
? sizeof(stats
.k3
) : sizeof(stats
.k2
);
71 memset(&stats
, 0, sizeof(stats
));
72 ret
= getsockopt(sock
, SOL_PACKET
, PACKET_STATISTICS
, &stats
, &slen
);
74 *packets
= stats
.k3
.tp_packets
;
75 *drops
= stats
.k3
.tp_drops
;
80 static inline bool is_tpacket_v3(int sock __maybe_unused
)
85 static inline size_t get_ring_layout_size(struct ring
*ring
, bool v3 __maybe_unused
)
87 return sizeof(ring
->layout
);
90 static inline void setup_rx_ring_layout_v3(struct ring
*ring __maybe_unused
)
94 static inline int rx_ring_get_num(struct ring
*ring
, bool v3 __maybe_unused
)
96 return ring
->layout
.tp_frame_nr
;
99 static inline size_t rx_ring_get_size(struct ring
*ring
, bool v3 __maybe_unused
)
101 return ring
->layout
.tp_frame_size
;
104 static int get_rx_net_stats(int sock
, uint64_t *packets
, uint64_t *drops
, bool v3 __maybe_unused
)
107 struct tpacket_stats stats
;
108 socklen_t slen
= sizeof(stats
);
110 memset(&stats
, 0, sizeof(stats
));
111 ret
= getsockopt(sock
, SOL_PACKET
, PACKET_STATISTICS
, &stats
, &slen
);
113 *packets
= stats
.tp_packets
;
114 *drops
= stats
.tp_drops
;
118 #endif /* HAVE_TPACKET3 */
120 void destroy_rx_ring(int sock
, struct ring
*ring
)
123 bool v3
= is_tpacket_v3(sock
);
125 munmap(ring
->mm_space
, ring
->mm_len
);
130 /* In general, this is freed during close(2) anyway. */
134 fmemset(&ring
->layout
, 0, sizeof(ring
->layout
));
135 ret
= setsockopt(sock
, SOL_PACKET
, PACKET_RX_RING
, &ring
->layout
,
136 sizeof(ring
->layout
));
138 panic("Cannot destroy the RX_RING: %s!\n", strerror(errno
));
141 static void setup_rx_ring_layout(int sock
, struct ring
*ring
, size_t size
,
142 bool jumbo_support
, bool v3
)
144 fmemset(&ring
->layout
, 0, sizeof(ring
->layout
));
146 ring
->layout
.tp_block_size
= (jumbo_support
?
147 RUNTIME_PAGE_SIZE
<< 4 :
148 RUNTIME_PAGE_SIZE
<< 2);
150 ring
->layout
.tp_frame_size
= (jumbo_support
?
151 TPACKET_ALIGNMENT
<< 12 :
152 TPACKET_ALIGNMENT
<< 7);
154 ring
->layout
.tp_block_nr
= size
/ ring
->layout
.tp_block_size
;
155 ring
->layout
.tp_frame_nr
= ring
->layout
.tp_block_size
/
156 ring
->layout
.tp_frame_size
*
157 ring
->layout
.tp_block_nr
;
160 setup_rx_ring_layout_v3(ring
);
161 set_sockopt_tpacket_v3(sock
);
163 set_sockopt_tpacket_v2(sock
);
166 ring_verify_layout(ring
);
169 static void create_rx_ring(int sock
, struct ring
*ring
, bool verbose
)
172 bool v3
= is_tpacket_v3(sock
);
173 size_t layout_size
= get_ring_layout_size(ring
, v3
);
176 ret
= setsockopt(sock
, SOL_PACKET
, PACKET_RX_RING
, &ring
->raw
,
179 if (errno
== ENOMEM
&& ring
->layout
.tp_block_nr
> 1) {
180 ring
->layout
.tp_block_nr
>>= 1;
181 ring
->layout
.tp_frame_nr
= ring
->layout
.tp_block_size
/
182 ring
->layout
.tp_frame_size
*
183 ring
->layout
.tp_block_nr
;
187 panic("Cannot allocate RX_RING!\n");
189 ring
->mm_len
= (size_t) ring
->layout
.tp_block_size
* ring
->layout
.tp_block_nr
;
193 printf("RX,V2: %.2Lf MiB, %u Frames, each %u Byte allocated\n",
194 (long double) ring
->mm_len
/ (1 << 20),
195 ring
->layout
.tp_frame_nr
, ring
->layout
.tp_frame_size
);
197 printf("RX,V3: %.2Lf MiB, %u Blocks, each %u Byte allocated\n",
198 (long double) ring
->mm_len
/ (1 << 20),
199 ring
->layout
.tp_block_nr
, ring
->layout
.tp_block_size
);
204 static void alloc_rx_ring_frames(int sock
, struct ring
*ring
)
206 bool v3
= is_tpacket_v3(sock
);
208 alloc_ring_frames_generic(ring
, rx_ring_get_num(ring
, v3
),
209 rx_ring_get_size(ring
, v3
));
212 void join_fanout_group(int sock
, uint32_t fanout_group
, uint32_t fanout_type
)
214 uint32_t fanout_opt
= 0;
217 if (fanout_group
== 0)
220 fanout_opt
= (fanout_group
& 0xffff) | (fanout_type
<< 16);
222 ret
= setsockopt(sock
, SOL_PACKET
, PACKET_FANOUT
, &fanout_opt
,
225 panic("Cannot set fanout ring mode!\n");
228 void ring_rx_setup(struct ring
*ring
, int sock
, size_t size
, int ifindex
,
229 struct pollfd
*poll
, bool v3
, bool jumbo_support
,
230 bool verbose
, uint32_t fanout_group
, uint32_t fanout_type
)
232 fmemset(ring
, 0, sizeof(*ring
));
233 setup_rx_ring_layout(sock
, ring
, size
, jumbo_support
, v3
);
234 create_rx_ring(sock
, ring
, verbose
);
235 mmap_ring_generic(sock
, ring
);
236 alloc_rx_ring_frames(sock
, ring
);
237 bind_ring_generic(sock
, ring
, ifindex
, false);
238 join_fanout_group(sock
, fanout_group
, fanout_type
);
239 prepare_polling(sock
, poll
);
242 void sock_rx_net_stats(int sock
, unsigned long seen
)
245 uint64_t packets
, drops
;
246 bool v3
= is_tpacket_v3(sock
);
248 ret
= get_rx_net_stats(sock
, &packets
, &drops
, v3
);
250 printf("\r%12"PRIu64
" packets incoming (%"PRIu64
" unread on exit)\n",
251 v3
? (uint64_t)seen
: packets
, v3
? packets
- seen
: 0);
252 printf("\r%12"PRIu64
" packets passed filter\n", packets
- drops
);
253 printf("\r%12"PRIu64
" packets failed filter (out of space)\n", drops
);
255 printf("\r%12.4lf%% packet droprate\n",
256 (1.0 * drops
/ packets
) * 100.0);