Tuesday, March 30, 2010

Berkely Packet Filters

I had to implement a feature to list down all the free IP addresses available on a given subnet. Theoretically ICMP orARP protocols could be used to do this, I chose ARP as it exactly fits my bill.

How to implement was not really clear ? I piped in data from arp command to my application, so that application development does not stop because of this. However this is not at all a good way, this forks a new process which is a bloody costly in my application context. One more thing is that arp command looks up the arp tables and does not send an arp packet to check the existence of an IP. Anyways that was make shift arrangement till I implement it the right way.

The main problem was that the ARP works at the data link layer and not on the transport layer. To implement I'll need to send link layer raw packets. Using any transport layer protocols will not serve the purpose. I banged my head for couple of days. Then I found my savior Berkley Packet Filters (bpf).

Any Unix like Operating systems will have some bpf devices. My Mac has 4 bpf devices. Using bpf we can send raw ethernet packets, with out the need of any transport layer protocol. However to receive the response from these raw ethernet packets, a packet sniffer needs to be implemented. Mac OSX ships libpcap (lib packet capture), I used this to create a packet sniffer.

Packet sniffer was capturing all kind of packets, just realized the amount of communication goes on, in the background. libcap allows applications to add filters I had to apply an filter to capture only ARP packets.

ARP implementation solved 2 of my problems.
- finding a list of free IP addresses on a given subnet
- finding Mac-address of the gateway on that subnet.

No comments:

Post a Comment

LinkWithin

Related Posts with Thumbnails