netgraph question : how to intercept incoming IP packets of a certain type?

[Ruslan Ermilov]

On Tue, Mar 01, 2005 at 10:47:07PM -0500, Aziz KEZZOU wrote:
> Hi folks,
> Here is what I want to do : "Intercept all incoming IP packets on an
> Ethernet interface of a certain type (e.g RSVP) and call my own
> function to process, all inside the kernel"
> 
> Netgraph nodes : ng_iface, nf_bpf (and probably ng_ether) look
> promising for this task but I can not figure out how to do it in
> practice...
>  
> Any help is appreciated. Thanks,
> 
I thought Julian already answered this...

You can do this with ng_ipfw(4) in -CURRENT.  Or you can filter
(with ng_bpf(4)) the packets of interest and forward them
somewhere.  Example:

 +---v
 | (upper)
 |  rl0: [ng_ether]
 | (lower)
 |   ^
 |   |
 |   v
 | (lower)
 | bpf_rl0: [ng_bpf]
 | (upper)
 +---^

[bpf] should be configured to forward matching packets received on
"lower" to some other hook, and non-matching packets to "upper".
Similarly for packets received on "upper", forward packets of
interest to some other hook, and non-matching packets to "lower".


Cheers,
-- 
Ruslan Ermilov
ru at FreeBSD.org
FreeBSD committer
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20050302/ebc95f5b/attachment.bin