Page 1 of 1

Intercepting Ethernet packets

Posted: Mon Jul 18, 2011 12:06 am
by bbracken
I would like to look at the raw ethernet packets being received by my NB. Is there a mechanism where I can capture the ethernet data before being passed up the higher levels of the network stack? There must be a hook somewhere. I'd thought I'd check first before diving into the ethernet firmware.

bb

Re: Intercepting Ethernet packets

Posted: Mon Jul 18, 2011 11:11 am
by tod
Bill,
Do you need this info inside the NB or do you just want to see the raw data? If the latter, on the off chance you're not aware of it, Wireshark will probably show you way more than you want.

Re: Intercepting Ethernet packets

Posted: Mon Jul 18, 2011 11:34 am
by lgitlitz
I agree that Wireshark is your best option for debugging. You may need to get a hub instead of a switch so that all the packets are visible. If you want to actually process packets on the line that are not addressed to the NetBurner then there are some other options. There is a callback function declared in ip.h that can be used to process "bad" ip packets.
typedef void ( PromisciousPacketFunc )( PoolPtr pp );
extern PromisciousPacketFunc *pPromisciousPacketFunc;
If this callback is set then it will be called when an incoming IP packet either has a destination address that is different then the NetBurner IP. Correctly addresses IP packets will be handled by the NetBurner and this will only receive the "error" IP packets. Normally, any packets sent to other addresses are filtered out by the Ethernet peripheral hardware. You will have to put the peripheral in pernicious mode for this to work. You will also likely need a hub as a switch will not route packets to the wrong address.

//Somewhere in iniitalization
sim.fec.rcr|=0x08; //Put chip in promiscuous mode.
pPromisciousPacketFunc=MyPromisciousPacketFunction;

//Add your function to process the packets....
void MyPromisciousPacketFunction(PoolPtr pp)
{
//Convert the raw ethernet frame to an IP packet...
PIPPKT pIp=GetIpPkt(pp);
if((pIp) && ([Ip->proto==IP_TCP))
{
//Get a TCP packet
PTCPPKT pTcpPkt=GetTcpPkt(pIp );
//Do something with the TCP packet here
}
else if((pIp) && ([Ip->proto==IP_UDP))
{
//Get a UDP packet PUDPPKT pUdp=GetUdpPkt( pIp )
//do something with the raw UDP packet
}
//Free the packet buffer when you are done.
FreeBuffer(pp);
}

Re: Intercepting Ethernet packets

Posted: Mon Jul 18, 2011 11:40 am
by bbracken
Tod,

Need the info inside the NB. I think NB has provided me with the links that I need. Thanks for the response.

bb

Re: Intercepting Ethernet packets

Posted: Mon Jul 18, 2011 11:50 am
by bbracken
Larry, Tod,

Thanks for the info. I just need to look at the type of packet being received (regardless of address) and then would like the NB to just "handle" the packet as it normally would. The project is a really simple sniffer. I'm up to speed on promiscuous mode, WireShark, etc. Just trying to figure out where to put a small snippet of code to interrogate the incomming packets and then queue a one or two byte code for processing later.

Thanks,
bb