creating an invisible network monitor.

scap1784 · Apprentice Joined: 25 Dec 2002 Posts: 225

The goal is the have two interfaces and have them in a bridging mode so that no ips are nessisary. I then want to be a to capture all packets and inject packets out both interfaces at the same time. This is so I can monitor the network and eventually create an intrusion dection and firewall application behind this. My question is how much of this do I need to write from scratch. i know the kernel offers bridging however I may or may not need to do a little kernel hacking for the rest. Does anyone know of anything I could use. Remember I do not want a tcp/ip stack for this application. I want to be able to stick this on the outgoing line of a network and monitor all connections this way...

ansient · Guru Joined: 22 Jan 2005 Posts: 445 Location: Argentina

Set up a kernel network bridge and run ethereal...

scap1784 · Apprentice Joined: 25 Dec 2002 Posts: 225

well that would work except that I want to be able to evolve this into something much more. i.e. intrusion detection and firewall among other things. I am going to write the application specifics myself and was just trying to see what apis/kernel patches/modules were out there to help me accomplish this.

- Scap

c.graves · Posted: Tue Jun 14, 2005 2:21 am Post subject:

this may help
_________________
cheers,
-c

Daniel_walmsley · Posted: Tue Jun 14, 2005 2:33 am Post subject:

Bandwidthd might be the monitoring tool your after

scap1784 · Apprentice Joined: 25 Dec 2002 Posts: 225

That is a good article however I still want to write my own application to do all of this so that I can try out different thing (injecting packets into certain tcp streams simulating certain attacks etc...) That will be useful for setting up the bridging interface. I guess what I really need is some way to access the network cards at a really low level before any kind of socket. I want all information that go to the nic and the ablity to send packets out of it that I form. This is not for any production setup this is more for experimentation in that is the reason I want to build it so that I have to ability to branch off and go in one direction if I find something to be interesting.

tetromino · Retired Dev Joined: 02 Dec 2003 Posts: 215

If you merely want to write arbitrary IP packets to the wire, read man 7 raw
If, on the other hand, you also want to have some fun with ethernet frames (spoof MAC addresses, configure packet fragmentation, etc) you should check out Documentation/networking/pktgen.txt in your kernel source tree. And if that doesn't meet your needs, you will need to do some kernel hacking.

ansient · Guru Joined: 22 Jan 2005 Posts: 445 Location: Argentina