Skip to content
This repository
tree: dd247b56d6

Fetching latest commit…

Octocat-spinner-32-eaf2f5

Cannot retrieve the latest commit at this time

Octocat-spinner-32 c_src
Octocat-spinner-32 ebin
Octocat-spinner-32 include
Octocat-spinner-32 src
Octocat-spinner-32 .gitignore
Octocat-spinner-32 Makefile
Octocat-spinner-32 README.md
Octocat-spinner-32 rebar.config
README.md

An Erlang port interface to libpcap.

epcap includes a small example program called sniff.

Changes

0.05: The packet message format has changed and is now documented.

QUICK SETUP

cd epcap
make

# Allow your user to epcap with root privs
sudo visudo
youruser ALL = NOPASSWD: /path/to/epcap/priv/epcap

erl -pa ebin deps/*/ebin
% Start the gen_server
sniff:start_link().

% Use your interface, or leave it out and trust in pcap
sniff:start([{interface, "eth0"}]).

% To change the filter
sniff:start([{filter, "icmp or (tcp and port 80)"},{interface, "eth0"}]).

% To stop sniffing
sniff:stop().

USAGE

epcap:start() -> pid()
epcap:start(Args) -> pid()

    Types   Args = [Options]
            Options = {chroot, string()} | {group, string()} | {interface, string()} | {promiscuous, boolean()} |
                        {user, string()} | {filter, string()} | {progname, string()} | {file, string()} |
                        {monitor, boolean()}

    Packets are delivered as messages:

        {packet, DataLinkType, Time, Length, Packet}

    The DataLinkType is an integer representing the link layer,
    e.g., ethernet, Linux cooked socket.

    The Time is a tuple in the same format as erlang:now/0, {MegaSecs,
    Secs, MicroSecs}.

    The Length corresponds to the actual packet length on the
    wire. The captured packet may have been truncated. To get the
    captured packet length, use byte_size(Packet).

    The Packet is a binary holding the captured data.

SCREENSHOT

=INFO REPORT==== 6-Jan-2010::20:35:18 ===
    time: "2010-01-06 20:35:18"
    caplen: 562
    len: 562
    source_macaddr: "0:16:B6:xx:xx:xx"
    source_address: {207,97,227,239}
    source_port: 80
    destination_macaddr: "0:15:AF:xx:xx:xx"
    destination_address: {192,168,1,2}
    destination_port: 56934
    protocol: tcp
    protocol_header: [{flags,["ack","psh"]},
                      {seq,2564452231},
                      {ack,3156269309},
                      {win,46}]
    payload_bytes: 492
    payload: "HTTP/1.1 301 Moved Permanently..Server: nginx/0.7.61..Date: Thu, 07 Jan 2010 01:35:17 GMT..Content-Type: text/html; charset=utf-8..Connection: close..Status: 301 Moved Permanently..Location: http://github.com/dashboard..X-Runtime: 2ms..Content-Length: 93..Set-Cookie: _github_ses=BAh7BiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%3D%3D--884981fc5aa85daf318eeff084d98e2cff92578f; path=/; expires=Wed, 01 Jan 2020 08:00:00 GMT; HttpOnly..Cache-Control: no-cache"

TODO

  • return error atoms/tuples instead of using errx

CONTRIBUTORS

  • Olivier Girondel:

    • preliminary IPv6 support
  • Harald Welte:

    • support reading packets from pcap file
    • SCTP support
    • datalink types
  • Gregory Haskins:

    • application file fix
Something went wrong with that request. Please try again.