c++pcapplusplus

PfRingDevice for lo interface


I'm using PF_RING and PCAP++ to capture and analyze net traffic.
Sometimes usefull to use lo interface (loopback): for tests and regression analyze.
By the way, there is constant silence in the loopback until you break it by your command.

PF_RING may give me loopback traffic.

#include <dnet.h>
#include <string>
#include <cstdint>

#include <pfring.h>

#include <pcapplusplus/Packet.h>
#include <pcapplusplus/IPv4Layer.h>

void main(int argc, char** argv) {
    std::string iface_name = "lo";
    if (argc > 1)
        iface_name = argv[1];

    pfring *ring = nullptr;
    uint32_t flags;
    flags = PF_RING_PROMISC |
            PF_RING_DO_NOT_PARSE |
            PF_RING_DO_NOT_TIMESTAMP;
    ring = pfring_open(iface_name.c_str(), MAX_CAPLEN, flags);
    pfring_set_application_name(ring, "traffic_capture");
    pfring_set_direction(ring, rx_only_direction);
    pfring_set_socket_mode(ring, recv_only_mode);
    pfring_enable_ring(ring);

    int res, i;
    u_char *packet;
    struct pfring_pkthdr pfring_hdr{};
    timeval timestamp{};
    uint32_t src_ip, dst_ip;

    for (i = 0; i < 10; ) {
        res = pfring_recv(ring, &packet, 0, &pfring_hdr, 1);
        if (res > 0) {
            timestamp = pfring_hdr.ts;
            pcpp::RawPacket raw_packet(packet, pfring_hdr.caplen, timestamp, false);
            // parse the raw packet into a parsed packet
            pcpp::Packet parsed_packet(&raw_packet);
            auto *ipLayer = parsed_packet.getLayerOfType<pcpp::IPv4Layer>();
            if (ipLayer != nullptr) {
                src_ip = ipLayer->getSrcIpAddress().toInt();
                dst_ip = ipLayer->getDstIpAddress().toInt();
                char buf_src[INET_ADDRSTRLEN];
                char buf_dst[INET_ADDRSTRLEN];
                printf("%s  -->  %s\n",
                        inet_ntop(AF_INET, &src_ip, buf_src, INET_ADDRSTRLEN),
                        inet_ntop(AF_INET, &dst_ip, buf_dst, INET_ADDRSTRLEN));
                i++;
            }
        }
    }
    pfring_close(ring);
    printf("DONE: processed %d packets\n", i);
    return 0;
}

To start capture run command: ping -I lo 127.0.0.3 or tcpreplay -i lo dump.pcap

How to choose lo working with PF_RING via PCAP++? How to set parameters for PF_RING such as opening flags, direction and socket_mode?

#include <iostream>
#include <string>
#include <pcapplusplus/PfRingDevice.h>
#include <pcapplusplus/PfRingDeviceList.h>

int main(int argc, char** argv){
    PfRingDevice *device = nullptr;

    // Get Default Interface Name using Shell
    std::string defaultInterface = "lo";
    if (argc > 1)
        defaultInterface = argv[1];

    auto devices = PfRingDeviceList::getInstance().getPfRingDevicesList();
    for (auto i: devices)
        std::cout << i->getDeviceName() << std::endl;

    // Get Instance of Default Interface
    device = PfRingDeviceList::getInstance().getPfRingDeviceByName(defaultInterface);
    if (device == nullptr) {
        std::cout << "Couldn't locate default Network Driver \n";
        return 1;
    }
    return 0;

This code prints only ens... or eth...
And it is not possible to choose lo.

Screenshots are bellow.
First program:
PF_RING listen loopback Second program:
loopback is not available through PCAP++


Solution

  • It seems that PF_RING doesn't support lo, please see this GitHub issue: https://github.com/ntop/PF_RING/issues/221

    I tested it also and lo isn't recognized by PF_RING.

    However, as suggested in the issue, you can set up a dummy interface which PF_RING can see:

    # ip link add dummy0 type dummy
    # ip link set dev dummy0 up
    

    UPDATE:

    The issue has been solved in commit 309e27a13b2c794103160a4652222dfb8d45b1b6. It is now possible to view and capture packets from lo in PfRingDevice