Member Avatar for dantinkakkar

I want to build a network protocol analyzer, but I really don't know where to start. Obviously, I don't want the code in hand, I can think it up myself -- but the problem is a little more specific - where do I look at to get the IPs passing in and out? Like, do I need to communicate with the router or look for an operating system-related layer? I'm on Ubuntu 10.04 LTS (Lucid Lynx)...

And I know about things like WireShark and DarkStat -- using them is not what I want. I want something a little more customized for my needs, so can anyone help me out?

[EDIT: I don't want existing software. I'm doing something for my personal use]

Edited by dantinkakkar because: n/a
  • 2 Contributors
  • 4 Replies
  • 306 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by dantinkakkar

Dani AI

Generated

Short practical roadmap (build vs. buy, where to capture)

  • Three realistic choices: capture on the host (you see traffic to/from that machine), capture at a router/TAP or mirrored switch port (you see many hosts), or use kernel-level flow tables (conntrack) for connection-level summaries. As hinted, promiscuous mode on your NIC is only part of the picture — on a switched network it won’t magically show other hosts’ unicast traffic unless the switch mirrors it to your port or you capture on the router/TAP. (wiki.wireshark.org)

How to implement on Linux and in Java

  • For a packet-level analyzer use libpcap (the standard capture API) and a Java wrapper such as Pcap4J. Libpcap gives you link-layer frames; wrappers let Java open interfaces, apply BPF filters like ip, and hand you parsed IPv4 headers (so you can extract src/dst IPs cheaply). (man7.org)

Example (very small sketch using Pcap4J)

PcapNetworkInterface nif = Pcaps.getDevByName("eth0");
PcapHandle handle = nif.openLive(65536, PromiscuousMode.PROMISCUOUS, 10);
Packet p = handle.getNextPacketEx();
IpV4Packet ip = p.get(IpV4Packet.class);
InetAddress src = ip.getHeader().getSrcAddr();
InetAddress dst = ip.getHeader().getDstAddr();

Kernel-level alternatives and permissions

  • On Linux you can also use AF_PACKET (packet sockets) if you want C-level raw access and lower overhead; packet sockets require CAP_NET_RAW. If you don’t want to run your whole process as root, grant just the needed capabilities with setcap (for example to the Java runtime or a helper binary) instead of blanket root. (man7.org)

If you only need “who talked to whom” (flows, not full packets)

  • Use conntrack (or nfqueue/libnetfilter_queue) to read kernel connection state or to send selected packets to userspace; this is lighter if you only need IP/port pairs and connection events rather than full payloads. (conntrack-tools.netfilter.org)

Troubleshooting notes

  • Start on the machine you care about (you already listed interfaces — good step, ). Verify you see incoming/outgoing traffic locally first, then move to switch/router capture if you need cross-host visibility. Use BPF to limit capture to IP headers to save CPU and I/O. (man7.org)

Recommended Answers

All 4 Replies

Member Avatar for gusano79

A direction you might look in is your network card's scandalously-named promiscuous mode.

Member Avatar for dantinkakkar

A direction you might look in is your network card's scandalously-named promiscuous mode.

Ya, I guess you got it right there, but will Java be enough for accessing it? Like, CAN I do it in Java? How I'll do it is a separate journey altogether :D but can I do it?

Member Avatar for gusano79

Ya, I guess you got it right there, but will Java be enough for accessing it? Like, CAN I do it in Java? How I'll do it is a separate journey altogether :D but can I do it?

Maybe someone who knows for sure can chime in; I don't think Java supports promiscuous sockets. If that's true, you'd have to come up with a native library and a JNI wrapper if you still wanted to use Java to analyze the traffic. For example, jNetPcap.

Member Avatar for dantinkakkar 
import java.io.*;
import java.net.*;
import java.util.*;
import static java.lang.System.out;

public class ListNets 
{
    public static void main(String args[]) throws SocketException {
        Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
        for (NetworkInterface netint : Collections.list(nets))
            displayInterfaceInformation(netint);
    }

    static void displayInterfaceInformation(NetworkInterface netint) throws SocketException {
        out.printf("Display name: %s\n", netint.getDisplayName());
        out.printf("Name: %s\n", netint.getName());
        Enumeration<InetAddress> inetAddresses = netint.getInetAddresses();
        for (InetAddress inetAddress : Collections.list(inetAddresses)) {
            out.printf("InetAddress: %s\n", inetAddress);
        }
        out.printf("\n");
     }
}

This displays the network interfaces available, and I'm somewhat sure that that's the thing being monitored. The code works perfectly, but how do I monitor them -- back to square one!?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.