Skip to content

Packet Sniffer for high speed packet capture using packet memory mapping based approach. Extracts packet details and also detects duplicate packets.

License

Notifications You must be signed in to change notification settings

arunppsg/packet-sniffer

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

20 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Packet Sniffer

An application which extracts payload and computes sha512 digest of the payload using sha256 digest of the payload from live traffic.

The code under src has the packet sniffer application. It can capture upto 10^5 packets/sec (tested using nping).

The code under test contains code for generation of high speed packets. It is currently under development.

Usage

cd src
make
sudo ./sniffer.o -c eth0 # the interface in which packets are received

Examples:

For capturing in interface eno1: ./sniffer -c eno1

For using 2 threads: ./sniffer -T 2

For capturing upto 10 seconds: ./sniffer -t 10

For choosing output json file name: ./sniffer -j output.json

For help: ./sniffer -h

For duplicate packet detection, to build index for bloom filter run the application in mode 1 and to perform detection, rerun it in mode 2.

./sniffer -m 1  # building bloom filter index
./sniffer -m 2  # performing detection

BloomFilter is a probabilistic data structure. Given that the application needs to capture n packets at a false positive rate of e, the configuration can be set as

./sniffer -m 1 -n 10000 -e 0.001

The same configuration should be used during testing.

About

Packet Sniffer for high speed packet capture using packet memory mapping based approach. Extracts packet details and also detects duplicate packets.

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published