https://github.com/marmeladema/netintercept
User space network intercepting library
https://github.com/marmeladema/netintercept
capture-packets pcap
Last synced: about 1 year ago
JSON representation
User space network intercepting library
- Host: GitHub
- URL: https://github.com/marmeladema/netintercept
- Owner: marmeladema
- License: mit
- Created: 2018-01-28T23:27:20.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2021-06-10T16:16:19.000Z (almost 5 years ago)
- Last Synced: 2025-04-01T05:11:36.250Z (about 1 year ago)
- Topics: capture-packets, pcap
- Language: C
- Size: 19.5 KB
- Stars: 18
- Watchers: 2
- Forks: 3
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# netintercept
User space network intercepting library
## What is netintercept?
netintercept is a library that allows you to intercept network traffic without priviledges and create clean pcap files that you can then read with your favorite network analysis tools (Wireshark, ...).
## How does it work?
It uses LD_PRELOAD environment variable to preload the library and redefine various network related functions from `GNU libc`, `Mozilla nspr`, or `OpenSSL` using `dlsym`:
```c
typedef ssize_t write_t(int fd, const void *buf, size_t count);
ssize_t write(int fd, const void *buf, size_t count) {
write_t write_func = dlsym(RTLD_NEXT, "write");
if(!write_func) {
printf("[%d] dlsym error: %s\n", getpid(), dlerror());
abort();
}
/* netintercept code */
int ret = write_func(fd, buf, count);
/* netintercept code */
return ret;
}
```
Then, each time the target program calls write, our function is called and is able to track file descriptor and write data to an output pcap file using `libpcap`.
In order to have a usable pcap file, we reconstruct "ideal" layer 3 (IPv4, IPv6) and layer 4 (TCP, UDP).
`Mozilla nspr` and `OpenSSL` libraries are also hooked to dump unencrypted traffic that we would see encrypted with kernel space traffic capture.
## Limitations
### Layer 2
This level of information is fully managed by the operating system and we can not get those reliably from user space.
Thus you will not see ARP request / response or even ethernet layer in the pcaps.
### Inline syscall
Because of the technique we use to hook function calls, we can not see inline syscall. Especially, we currently miss some `close` calls from the `GNU libc` itself.
To prevent this, we developed a clever file descriptor tracking system. If file descriptor has changed between two intercepted calls, we can deduce that we missed a `close` call. It works well in practice.
### Ideal layer 3/4
Because we reconstruct and simulate layer 3 and 4, you will not see real traffic as you would have with kernel space traffic capture.
## How to build it?
First you need to configure CMake build system:
cmake
Then, you can build the library:
make
## How to use it?
LD_PRELOAD=$PWD/netintercept.so
This will launch `` and dump network packets in `netintercept.pcap`
You can configure the name of the pcap file with the `NETINTERCEPT_FILE` environment variable. You can also use special patterns that will by dynamicaly replaced by their value:
* `%p`: pid of the running process
* `%t`: timestamp of start of the program
* `%h`: hostname
* `%e`: executable filename (without path prefix)
* `%E`: pathname of executable, with slashes ('/') replaced by exclamation marks ('!')
* `%u`: (numeric) real UID of dumped process
Those patterns are indeed inspired by the `/proc/sys/kernel/core_pattern` file from Linux (see man 5 core).
You can also select the packets you are interested in with a tcpdump filter using the `NETINTERCEPT_FILTER` environment variable:
LD_PRELOAD=$PWD/netintercept.so NETINTERCEPT_FILTER=tcp
For more information about tcpdump filters, read https://www.tcpdump.org/manpages/pcap-filter.7.html