libpcap

> what if this code becomes a library and is integrated as part of a long-lived program Cue one of my favourite comments[1]: /* * We divy out chunks of memory rather than call malloc each time so * we don't have to worry about leaking memory. It's probably * not a big deal if all this memory was wasted but if this ever * goes into a library that would probably not be a good idea. * * XXX - this *is* in a library.... */ (Of course, this consideration should be appropriately downweighted by YAGNI, as threading memory management through prototype or internal utility code can by itself easily force it into very non-prototype territory wrt effort.) [1] https://github.com/the-tcpdump-group/libpcap/blob/2180b6e56a...

There are a couple of approaches that might legitimately be simpler than using a general-purpose allocator: in a single-pass batch process, just throw things on the floor and let the OS sort it out on exit[1] (I think the D compiler does this); in a multiple-pass batch process, make each pass litter its own room (arena, obstack, etc.) then demolish said room when done (GCC does this or at least did in the past). On the other hand, these may require rearranging the logic somewhat to fit them, so the question of how much rearrangement to tolerate still remains. And, well[4], /* * We divy out chunks of memory rather than call malloc each time so * we don't have to worry about leaking memory. It's probably * not a big deal if all this memory was wasted but if this ever * goes into a library that would probably not be a good ide

No, it's not full implementation. The main difference between this and Zalewski implementation is using direct mapping data between kernel space and userspace. Zalewski implementation uses pcap for capturing packets. If you have huge workloads you can try this https://gist.github.com/xpahos/4bc215aa5fe237161bc076f247643... to try multithreaded capturing packets(https://github.com/the-tcpdump-group/libpcap/pull/674). My implementation creates a hash map between kernel space and userspace where eBPF(kernel space, directly from sk_buff) code stores parsed data in this map. After accepting a connection in userspace application could check this hash map and get data from kernel space to userspace. So it's possible to add p0f extra data to request headers directly inside load balancer/web server and pass it to underlying levels. > Does anybody

Tcpdump is amazing. The quickness that you can have with it over Wireshark is awesome. I love that it is a command line tool instead of a GUI tool, since I needed to analyze TCP packets for quick debugging purposes. But for the people who are new(ish) to tcpdump have you heard of libnet and libpcap? You can basically build your own tcpdump! :D I was amazed at the speed packets fire when you program it yourself in C. See: https://github.com/the-tcpdump-group/libpcap <-- CAPturing packets https://github.com/sam-github/libnet <-- sending packets Libnet tutorial that I used religiously: https://repolinux.wordpress.com/2011/09/18/libnet-1-1-tutori...