LKM-Get-Packet

Get the 5 tuple of the packet with the specified source IP from the kernel.

Features

Get the 5-tuple of the packet specifying the source IP from the kernel, source address, destination address, original port, destination port, and protocol, and pass the relevant information to the application, which stores the information in a file.

Usage

1. git clone
2. cd LKM-Get-Packet/
3. sudo ./build.sh
4. cd user/
5. go run user.go xxx.xxx.xxx.xxx

tips: If you want the program to run all the time, you need to set MAX_IP_COUNT to 0 in lkm.h.

......

sudo rmmod get_packet

Usage Examples

Dev environment

kernel: 4.4.0-193-generic

gcc: 5.4.0