/remote-sniff

Libpcap based remote sniffer

Primary LanguageC++

remote-sniff

Libpcap based remote sniffer

Consists of three components

  • Sniffer. Grabs packets from an interface and sends them over UDP to a given address. Requires root due to libpcap

  • Feeder. Creates either a TAP device or a named pipe (FIFO), listens for UDP packets on given address and sends them to the feeding device. Requires root if TAP mode is used

  • Wireshark (standalone). Reads the feeding device and shows the packets. The TAP device should appear nicely in the interface list, the FIFO should be opened explicitely

Example:

Consider a router with address 192.168.1.1 that routes traffic for 192.168.1.0/24 subnet on eth1 interface. Also consider a remote PC with 1.2.3.4 address and Wireshark installed.

root@router # ./sniffer eth1 1.2.3.4 31337

On the PC run

root@pc # ./feeder -t 0.0.0.0 31337 &
Created tap0
...
user@pc $ wireshark -k -i tap0

or

user@pc $ ./feeder -f 0.0.0.0 31337 &
Created /tmp/feed5aY3Dg/fifo
...
user@pc $ wireshark -k -i /tmp/feed5aY3Dg/fifo