is a high performance Linux network sniffer for packet inspection. Basically, it is similar to tcpdump, but it doesn't need a syscall per packet. Instead, it uses an memory mapped area within kernelspace for accessing packets without copying them to userspace ("zero-copy" mechanism), so during high bandwidth less packet drops than on standard libpcap-based sniffers will occur.
netsniff-ng is useful for protocol analysis and reverse engineering, network debugging, measurement of performance throughput or network statistics creation of incoming packets on central network nodes like routers or firewalls.
If you try to create custom socket filters with tcpdump -dd, you
have to edit the ret opcode of the resulting filter, otherwise your payload will be cut off:
0x6, 0, 0, 0xFFFFFFFF instead of 0x6, 0, 0, 0x00000060
The Linux kernel now takes skb->len instead of 0xFFFFFFFF. If you do not change it, the kernel will take
0x00000060 as buffer length and packets larger than 96 Byte will be cut off (filled with zero Bytes)!
For instance, use `eth0' or `wlan0' as the packet capturing network device.
Use a specific Berkeley Packet Filter program to filter incoming packets.
Have a look at the given examples in:
Run netsniff-ng in daemon mode, options -P, -L and -S are required, too.
Note: To gather statistics during runtime without the unix domain socket inode, just send SIGUSR1 to netsniff-ng.
Used to define the pidfile. In most cases you can define it as /var/run/netsniff-ng.pid.
Used to define the logfile. In most cases you can define it as /var/log/netsniff-ng.log.
Used to define the unix domain socket inode. In most cases you can define it as /tmp/netsniff-ng.uds.
Force system scheduler to schedule netsniff-ng only on specific CPUs. Parameters could be 0 for using only CPU0, 0,1 for using CPU0 and CPU1 or even 0-4 for using a whole CPU range. If you have a customized init process that leaves out a special CPU you could bind netsniff-ng on that free CPU for maximal performance. On the other hand, you can avoid scheduling netsniff-ng on CPUs which are reserved for other critical tasks.
Force system scheduler to not schedule netsniff-ng on specific CPUs. Parameter syntax is equivalent to -b.
Do not put netsniff-ng in high-priorized mode. Normally, netsniff-ng will be scheduled with high priority thus it may make use of the full CPUs timeslice. You can avoid this by setting -H.
This option sets netsniff-ng in non-blocking mode. If the RX_RING is empty for several reasons, netsniff-ng will be put to sleep and wait for new incoming packages. By setting -n netsniff-ng will spin (with 100% CPU usage) in non-blocking mode. This might be faster, but could slow down other processes.
Do not print captured packets to stdout (silent mode). That switch can be changes during runtime by sending SIGUSR2 to toggle verbose/silent mode.
Prints versioning information.
(C) 2009, 2010, by Daniel Borkmann and Emmanuel Roullit
For bug reports, questions, code contributions, cool hacks and all the rest: