Poster of Linux kernelThe best gift for a Linux geek


Section: User Manuals (8) Updated: January 2010
Local index Up


netsniff-ng - a high performance network sniffer for packet inspection  


netsniff-ng [-d device] [-f filter] [-b cpu] [-B cpu] [-P pid] [-L log] [-S af_unix] [-DHnsv]  


netsniff-ng is a high performance Linux network sniffer for packet inspection. Basically, it is similar to tcpdump, but it doesn't need a syscall per packet. Instead, it uses an memory mapped area within kernelspace for accessing packets without copying them to userspace ("zero-copy" mechanism), so during high bandwidth less packet drops than on standard libpcap-based sniffers will occur.

netsniff-ng is useful for protocol analysis and reverse engineering, network debugging, measurement of performance throughput or network statistics creation of incoming packets on central network nodes like routers or firewalls.  


If you try to create custom socket filters with tcpdump -dd, you have to edit the ret opcode of the resulting filter, otherwise your payload will be cut off:

0x6, 0, 0, 0xFFFFFFFF instead of 0x6, 0, 0, 0x00000060

The Linux kernel now takes skb->len instead of 0xFFFFFFFF. If you do not change it, the kernel will take 0x00000060 as buffer length and packets larger than 96 Byte will be cut off (filled with zero Bytes)!  


-d device
For instance, use `eth0' or `wlan0' as the packet capturing network device.

-f filter
Use a specific Berkeley Packet Filter program to filter incoming packets.
Have a look at the given examples in: /etc/netsniff-ng/rules

Run netsniff-ng in daemon mode, options -P, -L and -S are required, too.
Note: To gather statistics during runtime without the unix domain socket inode, just send SIGUSR1 to netsniff-ng.

-P pidfile
Used to define the pidfile. In most cases you can define it as /var/run/

-L logfile
Used to define the logfile. In most cases you can define it as /var/log/netsniff-ng.log.

-S inode
Used to define the unix domain socket inode. In most cases you can define it as /tmp/netsniff-ng.uds.

-b CPU
Force system scheduler to schedule netsniff-ng only on specific CPUs. Parameters could be 0 for using only CPU0, 0,1 for using CPU0 and CPU1 or even 0-4 for using a whole CPU range. If you have a customized init process that leaves out a special CPU you could bind netsniff-ng on that free CPU for maximal performance. On the other hand, you can avoid scheduling netsniff-ng on CPUs which are reserved for other critical tasks.

Force system scheduler to not schedule netsniff-ng on specific CPUs. Parameter syntax is equivalent to -b.

Do not put netsniff-ng in high-priorized mode. Normally, netsniff-ng will be scheduled with high priority thus it may make use of the full CPUs timeslice. You can avoid this by setting -H.

This option sets netsniff-ng in non-blocking mode. If the RX_RING is empty for several reasons, netsniff-ng will be put to sleep and wait for new incoming packages. By setting -n netsniff-ng will spin (with 100% CPU usage) in non-blocking mode. This might be faster, but could slow down other processes.

Do not print captured packets to stdout (silent mode). That switch can be changes during runtime by sending SIGUSR2 to toggle verbose/silent mode.

Prints versioning information.


(C) 2009, 2010, by Daniel Borkmann and Emmanuel Roullit

For bug reports, questions, code contributions, cool hacks and all the rest:





This document was created by man2html, using the manual pages.
Time: 22:02:02 GMT, April 16, 2011