search

Ongy / netlink-hs

Netlink communication for Haskell
BSD 3-Clause "New" or "Revised" License
2 stars 7 forks source link

can't get good SOCK_DIAG answers #8

Closed teto closed 5 years ago

teto commented 5 years ago

I am trying to retrieve some data from the SOCK_DIAG family http://man7.org/linux/man-pages/man7/sock_diag.7.html similiar to whtat the linux utility ss does.

I managed to craft the exact same packets as ss but I don't get the same answer as for some reason (the last messages when filtering on netlink.family == 4 are what I expect to get): netlink_sock_diag.pcapng.txt

but with my program https://github.com/teto/netlink_pm/tree/v5/hs, I get only "End of a dump" answers even though I create TCP connections in the background and run it with sudo: netlink_sock_diag_bad_answer.pcapng.txt

By the way in terms of the netlink-hs library design, I send "diag request" but expect "diag messages" so the signature of queryOne etc are useless, I need to use sendPacket and check by myself for the answers. sock diag answers are long, multipart messages,That's whyI think it's mandatory to export recvMulti from the module.

To sum up: 1/ any idea why even though my requests are exactly the same as ss requests I get different answers (I run it with sudo and TCP requests in background). 2/ could you export recvMulti from the module ? if my analysis is correct.

teto commented 5 years ago

so I managed to get an answer but still wondering if I could do without recvMulti, will try and update this later on.