search

nhorman / dropwatch

user space utility to interface to kernel dropwatch facility
GNU General Public License v2.0
632 stars 92 forks source link

Interface or Protocol based Filtering feature for Packet Alert-mode #63

Closed deepakk97 closed 5 months ago

deepakk97 commented 2 years ago

Dropwatch-filter-UT.pdf

Added support for filtering based on protocol or interface. 1.To filter only drops of a particular protocol [only drops in a particular protocol packets will be captured]: Set Command : set filter protocol [protocol num in hex] Clear Command : set filter clear protocol

2.To filter only drops on a particular network interface [only drops in a particular interface will be captured]: Set Command : set filter ifindex [index of interface] Clear Command : set filter clear ifindex

3.To clear all filters: set filter clear

nhorman commented 2 years ago

could you please improve the changelog messages? "Add files via upload" and "Merge Pull request 1" doesn't tell me anything about what those changes do

This also seems a little...specific. Filtering on ifindex seems like a fine idea, but there are several attributes that get attached to an alert message (NET_DM_ATTR_ORIGIN, IFINDEX, ORIG_LEN, PROTO, etc). If you want to add filtering, it seems like it would be nice to come up with a repeatable option/syntax match on any or all of those options. I.e provide command line syntax that lets you set a filter string of the form < [==] | [!=] | > ] | [<] > [&& | || ] .... That would give us the ability to filter on any of those attributes without having to update the userspace tool with new options any time we add a new attribute in the kernel

deepakk97 commented 2 years ago

I agree with your point.Let me make this filtering generic, so as to make it more scalable for future options.Let me update this over the weekend.

nhorman commented 1 year ago

ping, any update here?

nhorman commented 9 months ago

closing for lack of response. Please reopen if you pick this back up