lo接口的PfRingDevice

Question

我使用PF_RING和PCAP++来捕获和分析网络流量。

有时使用lo接口(回环)：用于测试和回归分析。

顺便说一句，在你被你的命令打破之前，回环中总是会保持沉默。

PF_RING可能会给我回送流量。

#include <dnet.h>
#include <string>
#include <cstdint>

#include <pfring.h>

#include <pcapplusplus/Packet.h>
#include <pcapplusplus/IPv4Layer.h>

void main(int argc, char** argv) {
    std::string iface_name = "lo";
    if (argc > 1)
        iface_name = argv[1];

    pfring *ring = nullptr;
    uint32_t flags;
    flags = PF_RING_PROMISC |
            PF_RING_DO_NOT_PARSE |
            PF_RING_DO_NOT_TIMESTAMP;
    ring = pfring_open(iface_name.c_str(), MAX_CAPLEN, flags);
    pfring_set_application_name(ring, "traffic_capture");
    pfring_set_direction(ring, rx_only_direction);
    pfring_set_socket_mode(ring, recv_only_mode);
    pfring_enable_ring(ring);

    int res, i;
    u_char *packet;
    struct pfring_pkthdr pfring_hdr{};
    timeval timestamp{};
    uint32_t src_ip, dst_ip;

    for (i = 0; i < 10; ) {
        res = pfring_recv(ring, &packet, 0, &pfring_hdr, 1);
        if (res > 0) {
            timestamp = pfring_hdr.ts;
            pcpp::RawPacket raw_packet(packet, pfring_hdr.caplen, timestamp, false);
            // parse the raw packet into a parsed packet
            pcpp::Packet parsed_packet(&raw_packet);
            auto *ipLayer = parsed_packet.getLayerOfType<pcpp::IPv4Layer>();
            if (ipLayer != nullptr) {
                src_ip = ipLayer->getSrcIpAddress().toInt();
                dst_ip = ipLayer->getDstIpAddress().toInt();
                char buf_src[INET_ADDRSTRLEN];
                char buf_dst[INET_ADDRSTRLEN];
                printf("%s  -->  %s\n",
                        inet_ntop(AF_INET, &src_ip, buf_src, INET_ADDRSTRLEN),
                        inet_ntop(AF_INET, &dst_ip, buf_dst, INET_ADDRSTRLEN));
                i++;
            }
        }
    }
    pfring_close(ring);
    printf("DONE: processed %d packets\n", i);
    return 0;
}

要启动捕获运行命令：ping -I lo 127.0.0.3或tcpreplay -i lo dump.pcap

如何选择lo与PF_RING通过PCAP++工作？如何为PF_RING设置打开标志、方向和socket_mode等参数？

#include <iostream>
#include <string>
#include <pcapplusplus/PfRingDevice.h>
#include <pcapplusplus/PfRingDeviceList.h>

int main(int argc, char** argv){
    PfRingDevice *device = nullptr;

    // Get Default Interface Name using Shell
    std::string defaultInterface = "lo";
    if (argc > 1)
        defaultInterface = argv[1];

    auto devices = PfRingDeviceList::getInstance().getPfRingDevicesList();
    for (auto i: devices)
        std::cout << i->getDeviceName() << std::endl;

    // Get Instance of Default Interface
    device = PfRingDeviceList::getInstance().getPfRingDeviceByName(defaultInterface);
    if (device == nullptr) {
        std::cout << "Couldn't locate default Network Driver \n";
        return 1;
    }
    return 0;

这段代码只打印..。或者是..。

选择lo是不可能的。

截图是低沉的。

第一个节目：

第二个节目：

​

Answer 1

PF_RING似乎不支持lo，请看GitHub问题：环/议题/221

我也测试了它，lo没有被PF_RING所识别。

但是，正如问题中所建议的，您可以设置一个虚拟接口，PF_RING可以看到：

# ip link add dummy0 type dummy
# ip link set dev dummy0 up

更新：

这个问题已经在commit 309e27a13b2c794103160a46522dfb8d45b1b6中解决了。现在可以在lo中在PfRingDevice中查看和捕获数据包。