Skip to content

Commit

Permalink
Convert README to markdown format
Browse files Browse the repository at this point in the history
  • Loading branch information
msantos committed Mar 9, 2011
1 parent 7979c35 commit 78759a7
Showing 1 changed file with 88 additions and 0 deletions.
88 changes: 88 additions & 0 deletions README.md
@@ -0,0 +1,88 @@

An Erlang port interface to libpcap.

epcap includes a small example program called sniff.


## QUICK SETUP

cd epcap
make

# Allow your user to epcap with root privs
sudo visudo
youruser ALL = NOPASSWD: /path/to/epcap/priv/epcap

erl -pa ebin deps/*/ebin
% Start the gen_server
sniff:start_link().

% Use your interface, or leave it out and trust in pcap
sniff:start([{interface, "eth0"}]).

% To change the filter
sniff:start([{filter, "icmp or (tcp and port 80)"},{interface, "eth0"}]).

% To stop sniffing
sniff:stop().


## USAGE

epcap:start() -> pid()
epcap:start(Args) -> pid()

Types Args = [Options]
Options = {chroot, string()} | {group, string()} | {interface, string()} | {promiscuous, boolean()} |
{user, string()} | {filter, string()} | {progname, string()} | {file, string()}


## SCREENSHOT

=INFO REPORT==== 6-Jan-2010::20:35:18 ===
time: "2010-01-06 20:35:18"
caplen: 562
len: 562
source_macaddr: "0:16:B6:xx:xx:xx"
source_address: {207,97,227,239}
source_port: 80
destination_macaddr: "0:15:AF:xx:xx:xx"
destination_address: {192,168,1,2}
destination_port: 56934
protocol: tcp
protocol_header: [{flags,["ack","psh"]},
{seq,2564452231},
{ack,3156269309},
{win,46}]
payload_bytes: 492
payload: "HTTP/1.1 301 Moved Permanently..Server: nginx/0.7.61..Date: Thu, 07 Jan 2010 01:35:17 GMT..Content-Type: text/html; charset=utf-8..Connection: close..Status: 301 Moved Permanently..Location: http://github.com/dashboard..X-Runtime: 2ms..Content-Length: 93..Set-Cookie: _github_ses=BAh7BiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%3D%3D--884981fc5aa85daf318eeff084d98e2cff92578f; path=/; expires=Wed, 01 Jan 2020 08:00:00 GMT; HttpOnly..Cache-Control: no-cache"


## TODO

* return error atoms/tuples instead of using errx

* DLTs
* DLT_NULL
* DLT_SLIP
* DLT_PPP
* DLT_RAW
* DLT\_PPP\_SERIAL
* DLT\_PPP\_ETHER
* DLT\_IEEE802\_11
* DLT_LOOP


## CONTRIBUTORS

* Olivier Girondel:
* preliminary IPv6 support

* Harald Welte:
* support reading packets from pcap file
* SCTP support
* datalink types

* Gregory Haskins:
* application file fix

0 comments on commit 78759a7

Please sign in to comment.