lemoer / bpfcountd

a small daemon to monitor network traffic using bpf (berkley packet filters)

bpfcountd

This daemon was created to obtain packet statistics in larger networks without stressing the cpu resources. bpfcountd will count the amount of packages and bytes over time (for each defined rule). The rules are defined using the tcpdump filter syntax (bpf). The collected data is provided on unix socket in plaintext.

Dependencies

• libpcap

Supported Platforms

• Tested:
  • Arch Linux
  • Debian
• Should work without special regards:
  • Any systemd based Linux distro
• Should work after integration in init system:
  • Linux
• No support yet:
  • Any other platform with libpcap support
  • The get_mac(...) is not cross platorm yet

Example

You can define multiple rules using the bpf syntax and assign an identifier to each of them. The format is <identifier>;<bpf>. See example below:

Filters

arp-me;arp and ether src $MAC
icmp6;icmp6
arp-reply-gratious;ether broadcast and arp[6:2] == 2

The statistics are exported via unix socket. The path is configurable by a command line parameter. The format of the output is <identifier>:<bytes>:<packetcount>.

Results

arp-me:450:10
icmp6:100:4
arp-reply-gratious:120:30

Kernel Prefilter

To reduce the impact on unrelated traffic, a prefilter should be configured. If set only packets matching the prefilter will be copied to userspace for further examination by bpfcountd.

Use with prometheus node_exporter:

Add a crontab:

* * * * * ${pathtobpfcountddir}/dist/prometheus_txtfile.sh /var/run/bpfcountd.${interface}.sock > /var/run/bpfcountd.${interface}.txt

HowTo

Installation

$> # install the dependencies on debian
$> apt-get install libpcap-dev
$>
$> # install bpfcountd (all platforms)
$> git clone <url>
$> cd bpfcountd
$> make
$> sudo make install
$> cp dist/[email protected] /lib/systemd/system/[email protected]

Help

$> bpfcountd -h
bpfcountd -i <interface> [-F <prefilter-expr>] -f <filterfile>
          [-b <buffer-size>] [-u <unixpath>] [-h]

-F <prefilter-expr>   an optional prefilter BPF expression, installed in the kernel
-f <filterfile>       a the main file where each line contains an id and a bpf
                      filter, seperated by a semicolon
-b <buffer-size>      size of the capture buffer in bytes (default: 2*1024*1024)
-u <unixpath>         path to the unix info socket (default is ./test.sock)

Configuration

Create /usr/local/etc/bpfcountd/<interface>.filters. Or you can take one of the example files in /usr/local/etc/bpfcountd/ first.

The format of the filter file:

<identifier1>;<bpf>
<identifier2>;<bpf>

You can use the $MAC placeholder in your bpf and it will be replaced by the mac address of the interface at runtime.

Results

I recommend openbsd-netcat to read the unix socket from your shell.

$> nc -U <unixpath>

systemd integration

Start

$> systemctl start bpfcountd@<interface>

Enable

$> systemctl enable bpfcountd@<interface>

Unix socket path

/var/run/bpfcountd.<interface>.sock

bpfcountd's Issues

Local denial of service - triggering SIGPIPE in the deamon

Local user with access to the UNIX Socket can cause bpfcountd to exit with SIGPIPE simply by connecting to the socket and close it without reading any data causing local denial of service.

Tested on Arch Linux / x86-64.

(gdb) r  -i wls1 -f ./filters.example
Starting program: [...]/git-github/bpfcountd/bpfcountd -i wls1 -f ./filters.example
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Device: wls1
id: arp-req; bpf: "arp[6:2] == 1";
id: arp-rep-norm; bpf: "not ether broadcast and arp[6:2] == 2";
id: arp-rep-grat; bpf: "ether broadcast and arp[6:2] == 2 and ether src 00:26:c6:12:6f:a4";

Program received signal SIGPIPE, Broken pipe.
0x00007ffff78d7c7d in send () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff78d7c7d in send () from /usr/lib/libc.so.6
#1  0x00000000004019cb in usock_sendstr (client_sock=5, str=0x7fffffffe5a0 "arp-rep-grat:0:0\n") at usock.c:45
#2  0x000000000040178b in main (argc=5, argv=0x7fffffffeae8) at main.c:158

You can reproduce the bug with this code:

sock.c.txt

>> ./sock ../test.sock 
prepare socket ... done
connecting to bpfcountd ... done
trigger SIGPIPE in bpfcountd ... done
testing if bpfcountd died ... yes rawr!

License?

Can you think about what license you would like to use for this project?

I would like to use your project in a commercial project if your desired license allows that. In return I want to implement reloading the filter file using a signal.