Ethereal-users: Re: [Ethereal-users] capture on Unix Sockets ?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: jim cromie <jcromie@xxxxxxxxxx>
Date: Tue, 26 Feb 2002 04:27:38 -0700
jim cromie wrote:

Guy Harris wrote:

is there any way to capture Unix sockets or FIFOs ( using Ethereal) ?

No.  The reason why UNIX-domain sockets and FIFOs don't show up on
capture interface lists is that there's no network interface involved,
and libpcap can only capture on network interfaces.

if not, is it reasonable to write a small program to
open such for reading, and echo stuff to UDP packets ?


Ok, so I tried it. heres a 1st cut.
there are still lots of issues, but it did manage to open some of the available sockets,
and receive a message from 1 of them.



Frame 1 (50 on wire, 50 captured)
   Arrival Time: Feb 26, 2002 03:30:37.751026000
   Time delta from previous packet: 0.000000000 seconds
   Time relative to first packet: 0.000000000 seconds
   Frame Number: 1
   Packet Length: 50 bytes
   Capture Length: 50 bytes
Ethernet II
   Destination: 00:00:00:00:00:00 (XEROX_00:00:00)
   Source: 00:00:00:00:00:00 (XEROX_00:00:00)
   Type: IP (0x0800)
Internet Protocol, Src Addr: localhost.localdomain (127.0.0.1), Dst Addr: localhost.localdomain (127.0.0.1)
   Version: 4
   Header length: 20 bytes
   Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
       0000 00.. = Differentiated Services Codepoint: Default (0x00)
       .... ..0. = ECN-Capable Transport (ECT): 0
       .... ...0 = ECN-CE: 0
   Total Length: 36
   Identification: 0xf316
   Flags: 0x04
       .1.. = Don't fragment: Set
       ..0. = More fragments: Not set
   Fragment offset: 0
   Time to live: 64
   Protocol: UDP (0x11)
   Header checksum: 0x49b0 (correct)
   Source: localhost.localdomain (127.0.0.1)
   Destination: localhost.localdomain (127.0.0.1)
User Datagram Protocol, Src Port: 20001 (20001), Dst Port: 20000 (20000)
   Source port: 20001 (20001)
   Destination port: 20000 (20000)
   Length: 16
   Checksum: 0x6549 (correct)
Data (8 bytes)

0000 00 01 00 40 00 00 00 00 ...@....

reply is ICMP destination unreachable
why ?  UDP is 'unreliable',


I had to drop the MSG_PEEK, cuz nobody else was reading it off the socket.
dunno whether Ive really tapped the line, or Ive replaced one receiver with another.

feedback welcome/encouraged.


#!/usr/bin/perl -w

use Getopt::Std;
use IO::Socket::UNIX;
use IO::Socket::INET;
use IO::Select;

getopts('l') or die "bad options\n";

if ($opt_l) {
   @endpoints = ("/dev/log", </tmp/*>, </tmp/.*/*>, </tmp/orbit-jimc/*>);

   foreach $fname (@endpoints) {
   if (-S $fname) {
       print "isa socket: $fname\n";
       push @socknames, $fname;
   }
   if (-p $fname) {
       print "isa fifo: $fname\n";
       push @fifonames, $fname;
   }
   }
}
print "found ", scalar @socknames,
   " sockets and ", scalar @fifonames, " fifos\n";

foreach my $sock (@socknames) {
   # print "opening $sock\n";
   $mon = IO::Socket::UNIX->new( Type => SOCK_STREAM,
                 #Local => $sock,
                 Peer => $sock,
                 );
   unless ($mon) {
   $mon = IO::Socket::UNIX->new( Type => SOCK_DGRAM,
                     #Local => $sock,
                     Peer => $sock,
                     );
   warn "bad socket open on $sock: $!\n";
   }
   if ($mon) {
   push @sockets, $mon;
   $sockname{$mon} = $sock;
   print "opening $sock\n";
   }
}

die "no sockets\n" unless @sockets;

print "process $$ opening sockets\n";
my $listener = IO::Select->new();
$listener->add(@sockets);

$out = IO::Socket::INET->new( Type => SOCK_DGRAM,
                 LocalHost => "127.0.0.1:20001",
                 PeerHost => "127.0.0.1:20000",
                 Proto => "udp",
                 )
   or warn "UDP socket failed: $!\n";

my $sr; # sockets ready
# ENTER service loop
while (1) {
   my ($rd,$wr,$err) = IO::Select->select ($listener,undef,undef,undef);
   print "got ", scalar @$rd, " ready\n";

   foreach my $r (@$rd) {
   $r->recv($buf, 10000, MSG_PEEK) or warn "recv: $!\n";
   $r->recv($buf, 10000) or warn "recv: $!\n";
   $out->send($buf);
   print("$sockname{$r} got <$buf> len ", length $buf,
         " val ", unpack("C*", $buf), "\n");

   print stat($sockname{$r});
   }
   foreach my $r (@$wr) {
   print "$r ready to write\n";
   }
   foreach my $r (@$err) {
   print "$r has errs\n";
   }
}
print("server closing\n");