Software:netsniff-ng
 | |
 | |
| Original author(s) | Daniel Borkmann |
|---|---|
| Developer(s) | Daniel Borkmann, Tobias Klauser, Herbert Haas, Emmanuel Roullit, Markus Amend and many others |
| Initial release | December, 2009 |
| Written in | C |
| Operating system | Linux |
| Available in | English |
| Type | |
| License | GPLv2[1] |
netsniff-ng is a free Linux network analyzer and networking toolkit originally written by Daniel Borkmann. Its gain of performance is reached by zero-copy mechanisms for network packets (RX_RING, TX_RING),[2] so that the Linux kernel does not need to copy packets from kernel space to user space via system calls such as recvmsg().[3] libpcap, starting with release 1.0.0, also supports the zero-copy mechanism on Linux for capturing (RX_RING), so programs using libpcap also use that mechanism on Linux.
Overview
netsniff-ng was initially created as a network sniffer with support of the Linux kernel packet-mmap interface for network packets, but later on, more tools have been added to make it a useful toolkit such as the iproute2 suite, for instance. Through the kernel's zero-copy interface, efficient packet processing can be reached even on commodity hardware. For instance, Gigabit Ethernet wire-speed has been reached with netsniff-ng's trafgen.[4][5] The netsniff-ng toolkit does not depend on the libpcap library. Moreover, no special operating system patches are needed to run the toolkit. netsniff-ng is free software and has been released under the terms of the GNU General Public License version 2.
The toolkit currently consists of a network analyzer, packet capturer and replayer, a wire-rate traffic generator, an encrypted multiuser IP tunnel, a Berkeley Packet Filter compiler, networking statistic tools, an autonomous system trace route and more:[6]
- netsniff-ng, a zero-copy analyzer, packet capturer and replayer, itself supporting the pcap file format
- trafgen, a zero-copy wire-rate traffic generator
- mausezahn, a packet generator and analyzer for HW/SW appliances with a Cisco-CLI
- bpfc, a Berkeley Packet Filter compiler
- ifpps, a top-like kernel networking statistics tool
- flowtop, a top-like netfilter connection tracking tool with Geo-IP information
- curvetun, a lightweight multiuser IP tunnel based on elliptic curve cryptography
- astraceroute, an autonomous system trace route utility with Geo-IP information
Distribution specific packages are available for all major operating system distributions such as Debian[7] or Fedora Linux. It has also been added to Xplico's Network Forensic Toolkit,[8] GRML Linux, SecurityOnion,[9] and to the Network Security Toolkit.[10] The netsniff-ng toolkit is also used in academia.[11][12]
Basic commands working in netsniff-ng
In these examples, it is assumed that eth0 is the used network interface. Programs in the netsniff-ng suite accept long options, e.g., --in ( -i ), --out ( -o ), --dev ( -d ).
- For geographical AS TCP SYN probe trace route to a website:
astraceroute -d eth0 -N -S -H <host e.g., netsniff-ng.org>
- For kernel networking statistics within promiscuous mode:
ifpps -d eth0 -p
- For high-speed network packet traffic generation, trafgen.txf is the packet configuration:
trafgen -d eth0 -c trafgen.txf
- For compiling a Berkeley Packet Filter fubar.bpf:
bpfc fubar.bpf
- For live-tracking of current TCP connections (including protocol, application name, city and country of source and destination):
flowtop
- For efficiently dumping network traffic in a pcap file:
netsniff-ng -i eth0 -o dump.pcap -s -b 0
Platforms
The netsniff-ng toolkit currently runs only on Linux systems. Its developers decline a port to Microsoft Windows.[13]
See also
- Comparison of packet analyzers
- Packet generator
- Traffic generation model
- OpenVPN
- Traceroute
- Wireshark
- Tcpdump
- Xplico
References
- ↑ "netsniff-ng license". https://github.com/borkmann/netsniff-ng/blob/master/COPYING.
- ↑ "Description of the Linux packet-mmap mechanism". https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/Documentation/networking/packet_mmap.txt. Retrieved 6 November 2011.
- ↑ "netsniff-ng Homepage, Abstract, Zero-copy". http://netsniff-ng.org. Retrieved 6 November 2011.
- ↑ "Network Security Toolkit Article about trafgen's performance capabilities". http://wiki.networksecuritytoolkit.org/nstwiki/index.php/LAN_Ethernet_Maximum_Rates,_Generation,_Capturing_%26_Monitoring. Retrieved 6 November 2011.
- ↑ "Developer's Blog about trafgen's Performance". 16 October 2011. http://blog.cryptoism.org/1318763742.html. Retrieved 6 November 2011.
- ↑ "netsniff-ng README". https://github.com/netsniff-ng/netsniff-ng/blob/master/README. Retrieved 16 February 2018.
- ↑ "netsnif-ng in Debian". http://packages.debian.org/testing/netsniff-ng.
- ↑ "Xplico support of netsniff-ng". http://www.xplico.org/archives/944. Retrieved 6 November 2011.
- ↑ "Security Onion 12.04 RC1 Available Now!". http://securityonion.blogspot.com/2012/12/security-onion-1204-rc1-available-now.html. Retrieved 16 December 2012.
- ↑ "Network Security Toolkit adds netsniff-ng". http://www.networksecuritytoolkit.org/nstpro/news/news.html. Retrieved 6 November 2011.
- ↑ "netsniff-ng's trafgen at University of Napoli Federico II". http://www.grid.unina.it/software/ITG/link.php. Retrieved 7 November 2011.
- ↑ "netsniff-ng's trafgen at Columbia University". https://www.cs.columbia.edu/~hgs/internet/traffic-generator.html. Retrieved 7 November 2011.
- ↑ "netsniff-ng FAQ declining a port to Microsoft Windows". http://netsniff-ng.org/faq.html#d14. Retrieved 21 June 2015.
External links
- Official netsniff-ng website
- netsniff-ng FAQ
- netsniff-ng at GitHub
- netsniff-ng mailing list archive
- Linux' packet mmap(), BPF, and the netsniff-ng toolkit, talk at DevConf (long)
- Packet Sockets, BPF, netsniff-ng, talk at OpenSourceDays (short)
- – Linux Administration and Privileged Commands Manual
 |  |
