1

I want to implement a security solution similar to MACsec that captures a packet in its entirety (including the MAC header) at an intermediate network node (e.g linux based switch), perform some processing on the packet, and then send it out the intermediate node.

Would you please point to me to appropriate resources that can help me do this. I am currently looking into solutions that require modification of the NIC driver. Is there any other simpler solution than this? How do others implement MACsec?

Please note that I am not looking to simply capture a packet using pcap and similar methods. What I am looking for is to be able to capture a packet before it passes through an intermediate node, tamper with it and send it the intended recipient.

Thank you

Improve this question

2 Answers 2

Reset to default
2

If you want to analyze the packet as the Linux kernel receives it you will have to write a kernel driver, possibly going as far as modifying the kernel itself. When the interface receives data the processing begins immediately. Anything that is registered to receive the next layer will have its handler called. Since the MAC header doesn't require very much processing the IP layer handler is the first one that starts to performing a lot of the processing.

If you want to manipulate the MAC header and do your own thing you'll have to insert yourself right after the MAC header is received, and before the IP processing. Or you could write a driver to be a virtual NIC. That way you could process the data as you see fit. The virtual NIC would see all of the data just as the real NIC does. This would probably be your best bet, as you don't want to start mucking about with the kernel, and rebuilding it just for your own project.

My answer here gives several good links for learning about Linux kernel networking. I would also suggest picking up Linux Kernel Networking: Implementation and Theory by Rami Rosen. Great resource for an in-depth look at the network stack.

MACSec at some point will be implemented in the kernel. IPSec for example keeps its security policies in the kernel while a userland daemon keeps track of tunnel connections. So unfortunately I believe you'll have to write some level of kernel code to perform the actions you want.

Improve this answer
4
  • Thank you Raz. That was helpful. From our initial investigation, we see that we may be able to achieve our goal by writing a kernel module that we write to capture the packet using sk_buff(...) both at the input and output NIC, instead of writing a new virtual driver or modifying the actual NIC driver. Do you think we are missing something?
    – cdev
    Nov 27, 2014 at 12:27
  • No that's a good point. As long as a kernel module registers with the stack to receive a copy of the buffer you should be able to manipulate it, and send it back out.
    – RoraΖ
    Nov 27, 2014 at 12:59
  • it looks like we are able to pick up the and manipulate the original packet itself (not a copy of it) and put it back to the stack. I will get back when we have more concrete results.
    – cdev
    Nov 27, 2014 at 14:17
  • I'd be interested in hearing how that works. I know at certain points the buffer gets cloned, but it might be a shallow copy. Feel free to shoot me an email. I'm curious about this.
    – RoraΖ
    Nov 27, 2014 at 14:30
0

A while ago I wanted to play a little bit with data packets like layer 2, layer 3 or higher layers. I found a nice tool, based on python to do that. This tool calls Scapy.
You can capture and manipulate packets. Or you can build a packet based filter for your need.

Improve this answer
2
  • I think Scapy only gives us a copy of the packet. what we are looking for is to be able to capture the actual packet do our job and send it out (just like what MACSec would do.
    – cdev
    Nov 27, 2014 at 12:28
  • Oh, because of my layer 2 filter I once built with scapy I thought it would caputre the original packet...
    – mushr00mer1990
    Dec 1, 2014 at 7:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .