GitHub

Filter Traffic AF_XDP example application

This application demonstrates PcapPlusPlus AF_XDP APIs.

It opens an AF_XDP socket, receives all packets on the socket and matches them by user-defined matching criteria such as source/dest IP, source/dest TCP/UDP port and more. Matched packets can be sent to another AF_XDP socket (or to the same socket), and/or be saved to a pcap file.

In addition, the application collect statistics on received, sent and matched packets: total RX/TX, number of packets per protocol, number of matched flows and number of matched packets.

Important:

  • This application runs only on Linux (XDP is not supported on non-Linux platforms)
  • In order to build this application follow the instructions on how to build PcapPlusPlus with XDP
  • This application (like all applications using XDP) should be run as 'sudo'

Using the utility

Basic usage:
    XdpTrafficFilter [-hvl] [-s INTERFACE_NAME] [-f FILENAME] [-i IPV4_ADDR] [-I IPV4_ADDR] [-p PORT] [-P PORT] [-r PROTOCOL] -n INTERFACE_NAME
Options:
    -h|--help                                  : Displays this help message and exits
    -v|--version                               : Displays the current version and exits
    -l|--list                                  : Print the list of network interfaces and exit
    -n|--interface-name       INTERFACE_NAME   : An interface name to open AF_XDP socket and receive packets from.
                                                 To see all available interfaces use the -l switch
    -s|--send-matched-packets INTERFACE_NAME   : Network interface name to send matched packets to.
                                                 The app will open another AF_XDP socket for sending packets.
                                                 Note: this interface can be the same one used to receive packets.
    -f|--save-matched-packets FILEPATH         : Save matched packets to pcap files under FILEPATH.
    -i|--match-source-ip      IPV4_ADDR        : Match source IPv4 address
    -I|--match-dest-ip        IPV4_ADDR        : Match destination IPv4 address
    -p|--match-source-port    PORT             : Match source TCP/UDP port
    -P|--match-dest-port      PORT             : Match destination TCP/UDP port
    -r|--match-protocol       PROTOCOL         : Match protocol. Valid values are 'TCP' or 'UDP'

Read the original on github.com ↗