Question about bridging code

[Julian Elischer]

On Wed, 9 Jul 2003 kw3wong at engmail.uwaterloo.ca wrote:

> Hi Julian,
> 
> Thanks for the tip, it looks like netgraph can do what I need to do. I've never 
> used netgraph before, so I better do some background reading first before 
> asking any more questions.
> 
> I guess once I moved away from the IP layer to the link layer, divert sockets 
> no longer make that much sense to use. Although it is very tempting since the 
> interface is just so simple... =)
> 
> Bernie
> 
> 
grab the source for nghook
/usr/src/usr.sbin/nghook

and hack it to open 2 interfaces at once


nghook would take teh arguments

nghook fxp0: lower    to intercept all packets coming in on fxp0 and 
 to be able to send packets out through it.
nghook fxp0: upper    intercepts all packets from the local machine
 that would go out through fxp0, and any packets you sed there would be
 received by the system.

If you hack nghook to open multiple of these connections than you can
read and write to teh various places at will.

alternatively you could hack the ng_bridge node to pass all packets to
you.


As luigi suggest, you could also use the 'tap' interface
type of thing using a bridge of some type so get the 
oackets you want to it.

This is effectively the same as the ng_eiface node type
except that the eiface netgraph passes its output through a 
netgraph interface so that it can be piped through more netgraph nodes
(e.g. filterred or fed into a socket directly) where tap passes its data
to a device /dev/tapX.

Having done quite a bit of this I suggest 
you look at http://ezine.daemonnews.org/200003/netgraph.html
for an overview of how netgraph works...

julian