Re: Magic Lantern

[Eric Weigle <ehw@lanl.gov>]

> > "Richard B. Johnson" <root@chaos.analogic.com> writes:
> > > Are there currently any kernel hooks to support Magic Lantern?
> > > Basically, a "tee" to capture all network packets and pass them
> > > on to a filtering task without affecting normal network activity.
> > > It's like `tcpdump`, but allows packets to be inserted into the
> > > output queue as well without affecting normal network activity.
> > 
> > The af_packet module can read and write raw ethernet frames.
The af_packet module may also be fairly inefficient. If you need performance
over, say, a gigabit link, you may have trouble. I last used it one of the
earlier 2.4 series (2.4.8 I think) with the Acenic Tigon II gigE copper
cards to implement a network flooder; At that time a simple unoptimized loop
sending raw ethernet packets maxed out at at around 80Mbps, while the same loop
sending UDP packets maxed out at around 400. This may have been fixed by now,
I don't know... Just a warning.

-Eric

-- 
--------------------------------------------
 Eric H. Weigle   CCS-1, RADIANT team
 ehw@lanl.gov     Los Alamos National Lab
 (505) 665-4937   http://home.lanl.gov/ehw/
--------------------------------------------