Setable source port for samplicated packets

[sleinen]

From george...@gmail.com on August 06, 2010 11:47:40

In our company we need to have always same source port for samplicated packets, so I wrote a small patch, which allows that. I think it might be useful also for other users, at least as a optional patch.

Patch adds option to set source port into receiver settings.

A.B.C.D[/port[/freq][,ttl][.src_port]]

It's not optimal, because Samplicator uses only one socket for all outgoing packets so source port is set only once, when first modified receiver is found.

Source port settings are ignored in spoof mode (-S).

Attachment: samplicator-1.3.6-src_port.patch

Original issue: http://code.google.com/p/samplicator/issues/detail?id=3

[sleinen]

From simon.le...@gmail.com on August 11, 2010 12:36:30

That's a useful change, thanks for submitting it.

Before merging this, I would like better handling of the case where the user specifies different source ports for different destinations. The program should either handle this correctly (which would require multiple sockets, at least in the "cooked" case), or if it isn't able to do so, print an error message and terminate.

Labels: -Type-Defect Type-Enhancement

[sleinen]

From simon.le...@gmail.com on August 12, 2010 15:05:09

As the patch is currently written, I doubt that the source-port selection works when source address spoofing is used. If both a source port and source address spoofing is requested, samplicator should use the original source address and the user-requested source port. Because spoofing uses a "raw" socket, and the source address (including port) is explicitly put in each outgoing packet, the code could continue to use a single socket for multiple destinations even when different source-ports were specified.

[sleinen]

From george...@gmail.com on August 13, 2010 01:46:16

Thanks for comments. I tried to do as least changes as possible. I wasn't sure if using more then one socket is good idea. Do you think if it's better to create own socket for each destination, or to only create socket when new one is needed.

I also wasn't sure if overwriting port number in spoof mode is good idea. It won't be hard to fix.

[alebourdoulous]

hello,

I would like to known if the feature "Setable source port for samplicated packet" is available in the latest release 1.3.8, I do not think so . If spoof mode this is set, the samplicator conserve the original source address in replicated packets, I need than the original source port also preserved. We use riverbed collector which uses the source address and source port in NetFlow accounting packets.

Best regard's