This ppt show concept of Data Link Access, BSD Packet Filter, DLPI, Linux SOCK_PACKET, libpcap–Packet capture Library, libnet: Packet Creation and Injection Library

1. Socket Programming – Data
Link Access
Copyright by Hacking Feder
Powered by LJ Projects

2. Data Link Access
 If datalink access is provided then, application could watch the packets
received by the datalink layer
 Eg. Implementation tcpdump, wireshark, etherial
 For that application will put interface in promiscuous mode
2
Copyright by Hacking Feder

3. Data Link Access
 Promiscuous mode allows an application to watch all the packets on the
local interface, not just the packets destined for the host on which the
program is running
 It is not useful in switched network to sniff data of computers connected in
LAN (Certain methods available to achieve that)
3
Copyright by Hacking Feder

4. Data Link Access
 Three Common Methods to access Data link layer:
1. BSD Packet Filter (BPF)
2. Data link Provide interface (DLPI)
3. Linux packet SOCK_PACKET interface
4
Copyright by Hacking Feder

5. BSD Packet Filter
 Berkeley Software Distribution (BSD, sometimes called Berkeley Unix) is a
Unix operating system derivative developed and distributed by the
Computer Systems Research Group (CSRG) of the University of California,
Berkeley, from 1977 to 1995
 After 1991, BSD was open source
5
Copyright by Hacking Feder

6. 6
Copyright by Hacking Feder

7. BSD Packet Filter
 BPF Filtering is in within kernal
 By default print only header value
 It will be done before copying the packet
7
Copyright by Hacking Feder

8. DLPI
 It is protocol independent interface designed by AT & T
8
Copyright by Hacking Feder

9. DLPI
 Conceptually similar to BPF
 pfmod uses boolean expression for filtering
 BPF is 3 to 20 time faster them DLPI
9
Copyright by Hacking Feder

10. Linux SOCK_PACKET
 Create a socket of SOCK_PACKET type
 ETH_P_xxx tells the datalink which frame types to pass to the socket for the
frames the datalink receives
10
Copyright by Hacking Feder

11. Linux SOCK_PACKET
 As compare to BPF, and DLPI, here no kernal filtering and buffering
 SOCK_PACKET offers filtering by device
11
Copyright by Hacking Feder

12. libpcap – Packet capture Library
 The packet capture library, libpcap, provides implementation-independent
access to the underlying packet capture facility provided by the OS
 Currently, it supports only the reading of packets
 Support currently exists for BPF under Berkeley-derived kernels, DLPI under
HP-UX and Solaris 2.x, NIT under SunOS 4.1.x, the Linux SOCK_PACKET and
PF_PACKET sockets, and a few other operating systems
 This library is used by tcpdump, wireshark and etherial application
12
Copyright by Hacking Feder

13. libnet: Packet Creation and Injection Library
 libnet provides an interface to craft and inject arbitrary packets into the
network
 The library hides many of the details of crafting the IP and UDP or TCP
headers, and provides simple and portable access to writing data link and
raw packets
13
Copyright by Hacking Feder

14. #Connect with us
Facebook
Twitter
14