freeBSD /ipfw/ divert socket

[Guy Helmer]

Amit Mondal wrote:
> Hi All,
>
> I need a little help with FreeBSD Kernel stuff. I wanna use Divert Socket to
> sniff IP packet in FreeBSD.
> For that I have compiled the kernel with options IPDIVERT and everything is
> ok.
>
> Now, when I am not really sniffing and re-injecting the packet back to the
> network stack, it is basically dropping all the packets. But I want it
> pass-through it, when no application is reading at divert socket. My
> question is, HOW CAN I MAKE IT PASS-THROUGH? IF NO APPLICATION IS READING
> FROM DIVERT SOCKET, IT SHOULD WORK AS IF THERE IS NO DIVERT SOCKET.
>
> Thanks in adavnce
>
> Rgds
> Amit
>
>   
Speaking from experience, it would be trivial to borrow 
sys/netgraph/ng_tee.c and modify it to pass packets through the 
left2right and right2left hooks when the hooks are connected, and pass 
packets directly right or left when the left2right and right2left hooks 
aren't connected.  Then netgraph sockets can be constructed from 
userland programs to connect to the left2right and right2left hook.  
Packets will be passed to your program when your sockets are connected, 
and otherwise packets will skip right through the modified netgraph tee 
when the sockets aren't connected.

Hope this helps,
Guy

-- 
Guy Helmer, Ph.D.
Principal System Architect
Palisade Systems, Inc.