Add promiscuous mode capture support w/ tcpdump
- Dominant language
- Go
- Stars
- 19.3k
- Forks
- 2k
- Avg merge
- 3d 5h
- Merged PRs (30d)
- 264
Description
https://github.com/google/gvisor/issues/173 is now fixed and tcpdump mostly works except when using it with gVisor in promiscuous mode. This requires supporting a few missing AF_PACKET features namely
https://man7.org/linux/man-pages/man7/packet.7.html
PACKET_ADD_MEMBERSHIP
PACKET_DROP_MEMBERSHIP
Packet sockets can be used to configure physical-layer multi‐
casting and promiscuous mode. PACKET_ADD_MEMBERSHIP adds a
binding and PACKET_DROP_MEMBERSHIP drops it. They both expect
a packet_mreq structure as argument:
struct packet_mreq {
int mr_ifindex; /* interface index */
unsigned short mr_type; /* action */
unsigned short mr_alen; /* address length */
unsigned char mr_address[8]; /* physical-layer address */
};
mr_ifindex contains the interface index for the interface
whose status should be changed. The mr_type field specifies
which action to perform. PACKET_MR_PROMISC enables receiving
all packets on a shared medium (often known as "promiscuous
mode"), PACKET_MR_MULTICAST binds the socket to the physical-
layer multicast group specified in mr_address and mr_alen, and
PACKET_MR_ALLMULTI sets the socket up to receive all multicast
packets arriving at the interface.
In addition, the traditional ioctls SIOCSIFFLAGS, SIOCADD‐
MULTI, SIOCDELMULTI can be used for the same purpose.
tcpdump also seems to use
PACKET_AUXDATA (since Linux 2.6.21)
If this binary option is enabled, the packet socket passes a
metadata structure along with each packet in the recvmsg(2)
control field. The structure can be read with cmsg(3). It is
defined as
struct tpacket_auxdata {
__u32 tp_status;
__u32 tp_len; /* packet length */
__u32 tp_snaplen; /* captured length */
__u16 tp_mac;
__u16 tp_net;
__u16 tp_vlan_tci;
__u16 tp_vlan_tpid; /* Since Linux 3.14; earlier, these
were unused padding bytes */
};
Separately we may at some point need to add support for PACKET_RX_RING etc for high speed packet capture but that is a very low priority.
Contributor guide
Assessment
This issue has not been assessed yet.