I'm using PF_RING and PCAP++ to capture and analyze net traffic.
Sometimes usefull to use lo
interface (loopback): for tests and regression analyze.
By the way, there is constant silence in the loopback until you break it by your command.
PF_RING may give me loopback traffic.
#include <dnet.h>
#include <string>
#include <cstdint>
#include <pfring.h>
#include <pcapplusplus/Packet.h>
#include <pcapplusplus/IPv4Layer.h>
void main(int argc, char** argv) {
std::string iface_name = "lo";
if (argc > 1)
iface_name = argv[1];
pfring *ring = nullptr;
uint32_t flags;
flags = PF_RING_PROMISC |
PF_RING_DO_NOT_PARSE |
PF_RING_DO_NOT_TIMESTAMP;
ring = pfring_open(iface_name.c_str(), MAX_CAPLEN, flags);
pfring_set_application_name(ring, "traffic_capture");
pfring_set_direction(ring, rx_only_direction);
pfring_set_socket_mode(ring, recv_only_mode);
pfring_enable_ring(ring);
int res, i;
u_char *packet;
struct pfring_pkthdr pfring_hdr{};
timeval timestamp{};
uint32_t src_ip, dst_ip;
for (i = 0; i < 10; ) {
res = pfring_recv(ring, &packet, 0, &pfring_hdr, 1);
if (res > 0) {
timestamp = pfring_hdr.ts;
pcpp::RawPacket raw_packet(packet, pfring_hdr.caplen, timestamp, false);
// parse the raw packet into a parsed packet
pcpp::Packet parsed_packet(&raw_packet);
auto *ipLayer = parsed_packet.getLayerOfType<pcpp::IPv4Layer>();
if (ipLayer != nullptr) {
src_ip = ipLayer->getSrcIpAddress().toInt();
dst_ip = ipLayer->getDstIpAddress().toInt();
char buf_src[INET_ADDRSTRLEN];
char buf_dst[INET_ADDRSTRLEN];
printf("%s --> %s\n",
inet_ntop(AF_INET, &src_ip, buf_src, INET_ADDRSTRLEN),
inet_ntop(AF_INET, &dst_ip, buf_dst, INET_ADDRSTRLEN));
i++;
}
}
}
pfring_close(ring);
printf("DONE: processed %d packets\n", i);
return 0;
}
To start capture run command: ping -I lo 127.0.0.3
or tcpreplay -i lo dump.pcap
How to choose lo
working with PF_RING via PCAP++?
How to set parameters for PF_RING such as opening flags, direction and socket_mode?
#include <iostream>
#include <string>
#include <pcapplusplus/PfRingDevice.h>
#include <pcapplusplus/PfRingDeviceList.h>
int main(int argc, char** argv){
PfRingDevice *device = nullptr;
// Get Default Interface Name using Shell
std::string defaultInterface = "lo";
if (argc > 1)
defaultInterface = argv[1];
auto devices = PfRingDeviceList::getInstance().getPfRingDevicesList();
for (auto i: devices)
std::cout << i->getDeviceName() << std::endl;
// Get Instance of Default Interface
device = PfRingDeviceList::getInstance().getPfRingDeviceByName(defaultInterface);
if (device == nullptr) {
std::cout << "Couldn't locate default Network Driver \n";
return 1;
}
return 0;
This code prints only ens... or eth...
And it is not possible to choose lo
.
It seems that PF_RING doesn't support lo
, please see this GitHub issue: https://github.com/ntop/PF_RING/issues/221
I tested it also and lo
isn't recognized by PF_RING.
However, as suggested in the issue, you can set up a dummy interface which PF_RING can see:
# ip link add dummy0 type dummy
# ip link set dev dummy0 up
UPDATE:
The issue has been solved in commit 309e27a13b2c794103160a4652222dfb8d45b1b6. It is now possible to view and capture packets from lo
in PfRingDevice