Add Book to My BookshelfPurchase This Book Online

Appendix E - Accessing the Network at the Link Level

UNIX Systems Programming for SVR4
David A. Curry
 Copyright © 1996 O'Reilly & Associates, Inc.

Network Monitoring
The other task that cannot be performed through the socket and TLI interfaces is network monitoring. A network monitoring program, such as the snoop program included with SVR4, must be able to receive all packets on a network, regardless of who they are addressed to. But the socket and TLI interfaces require a program to specify an address at which it wishes to receive data. There is no way to specify “give me everything on the network, including all the stuff addressed to other machines.”
In order to monitor the network, a network monitoring program has to be able to place the system's network interface(s) into promiscuous mode. In this mode, the network interface copies all packets from the network rather than just those that are destined for the local host. The operating system must then arrange for the monitoring program to be given a copy of all of these packets. While it's doing that, though, it also has to continue processing all the packets addressed to it in the normal fashion, or else turning on a network monitor would turn off everything else.

Previous SectionNext Section
Books24x7.com, Inc © 2000 –  Feedback