skbdump's Introduction

skbdump

skbdump takes advantages of tc-bpf(8) to dump traffic on a network.

This tool is created by the following motives:

tcpdump(8) is bypassed when a bpf program on a device redirects the skb to another device;
tcpdump(8) works slowly and affects network performance;
tcpdump(8) -i any relies on Linux cooked-mode capture (SLL) and the link layer header isn't available;
tcpdump(8) doesn't reflect the information of direction: egress or ingress;
tcpdump(8) can't capture the skb metadata in the struct __sk_buff;

However, tcpdump(8) does have something I really appriciate, such as pcap-filter(7) for packet filtering, and I want to make sure my tool can still leverage the power of that.

Installation

Please download the latest binary in the releases.

Requirements

libpcap is required for Linux, for Ubuntu:

apt install libpcap-dev

Usage

Usage of skbdump:
  -i, --interface string       interface to capture (default "lo")
  -w, --pcap-filename string   output pcap filename (default "skbdump.pcap")
      --perf-output            use bpf_perf_event_output to lift payload size limit
  -s, --skb-filename string    output skb filename (default "skbdump.skb")

Please be aware that every capture will dump two files, one is pcap file which I recommand you open it by wireshark, and the other is skb text file just simply recording skb metadata in JSON.

Some examples:

skbdump -i eth0 port 80 and host 10.10.1.1
skbdump -i eth0 udp or arp
skbdump -i any icmp or icmp6
skbdump -i any ip6 and dst host fd04::18ab
skbdump -i veth 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

Known Issues

Currently the tool only supports capturing packets with maximum 1500 bytes in default mode (bpf queue output mode).
Using perf output mode can capture payload larger than 1500 bytes, but it's likely to mess up the event order and get some events lost.

Recommend Projects