Introduction
netsniff-ng is a free, performant Linux networking toolkit.
The gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa.
Our toolkit can be used for network development and analysis, debugging, auditing or network reconnaissance.
Toolkit
* netsniff-ng is a high-performance network analyzer based on packet mmap(2) mechanisms. It can record pcap files to disc, replay them and also do an offline and online analysis.
* trafgen is a high-performance network traffic generator based on packet mmap(2) mechanisms. It has its own flexible, macro-based low-level packet configuration language.
* mausezahn is a performant high-level packet generator that can run on a hardware-software appliance and comes with a Cisco-like CLI. It can craft nearly every possible or impossible packet.
* bpfc is a Berkeley Packet Filter (BPF) compiler that understands the original BPF language developed by McCanne and Jacobson. It accepts BPF mnemonics and converts them into kernel/netsniff-ng readable BPF opcodes.
* ifpps is a tool which periodically provides top-like networking and system statistics from the Linux kernel. It gathers statistical data directly from procfs files and does not apply any user space traffic monitoring that would falsify statistics on high packet rates. For wireless, data about link connectivity is provided as well.
* flowtop is a top-like connection tracking tool that can run on an end host or router. It is able to present TCP or UDP flows that have been collected by the kernel's netfilter framework. GeoIP and TCP state machine information is displayed.
* curvetun is a lightweight, high-speed ECDH multiuser VPN for Linux. curvetun uses the Linux TUN/TAP interface and supports {IPv4,IPv6} over {IPv4,IPv6} with UDP or TCP as carrier protocols.
* astraceroute is an autonomous system (AS) trace route utility. Unlike traceroute or tcptraceroute, it not only display hops, but also their AS information they belong to as well as GeoIP information and other interesting things.
For more information see the netsniff-ng homepage, FAQ, and the Documentation directory
Installation
Tested in default install of Ubuntu Desktop 12.04 x86_64 and Ubuntu Server 12.04 x86_64.
sudo apt-get install git build-essential flex bison ccache libnl-3-dev libnl-genl-3-dev libgeoip-dev libnetfilter-conntrack-dev asciidoc libncurses5-dev liburcu-dev libnet1-dev libpcap-dev
git clone https://github.com/borkmann/netsniff-ng cd netsniff-ng/src make sudo make install
For more options:
make help
You may encounter an error like the following when building curvetun:
./nacl_path.sh: 20: ./nacl_path.sh: source: not found Done! source ~/.bashrc /bin/sh: 1: source: not found make: *** [nacl] Error 127
If that's the case, then source your ~/.bashrc to pick up the two new NACL variables:
source ~/.bashrc
Then build again:
make && sudo make install
Examples
Netsniff-ng
Write traffic coming in on eth0 to dump.pcap and don't print any output:
netsniff-ng --in eth0 --out dump.pcap --silent --bind-cpu 0
Netsniff-ng is great for full content packet capture. The following example will write a new pcap to the /mypcaps directory each day.
netsniff-ng --in eth0 --out /mypcaps --interval 24hrs
Using mmap(), send quickly, packets from eth0 to eth1.
netsniff-ng --in eth0 --out eth1 --mmap --silent --prio-high
Replay a network trace to an IDS listening on eth0 or attached to a hub.
netsniff-ng --in dump.pcap --mmap --out eth0 -k1000 --silent --bind-cpu 1
Apply a BPF filter, print matched packets in ASCII, accept jumbo frames, and increase verbosity:
netsniff-ng --in any --filter http.bpf --jumbo-support --ascii -V
Ifpps
Print system statistics every 1 second (1000ms):
ifpps --dev eth0 --promisc
Write statistics every 5 seconds to a file in CSV format and print the PPS and drop count fields per interval.
ifpps --dev eth0 --interval 5 --promisc --csv -l > stats.csv
awk '{ print $4,$5 }' stats.csv