Libtins – High-level and multiplatform C++ network packet sniffing and crafting
1–10 of 23 posts
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#2>Note: the scapy benchmarks look like it takes almost the same time as the impacket ones, but it actually doesn't. In fact, it takes so much time that the maximum Y-axis value had to be restricted. Otherwise the rest of the bars couldn't almost be seen. If you hover over each bar, you will see the actual times in seconds.
wow, they weren't kidding. In the first and the last graph, scapy is ten times slower than the next slowest lib.
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#3[deleted]
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#4How flexible it is despite being high level? I mean, can I use any field on those supported protocols? Can I tunnel TCP inside, say, dns? can I implement/send custom protocols without touching the lib?
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#5Also check out packit[1] a command line packet crafter. It is very easy to use once you really understand how to use it. Also it has no 'restrictions' on what packets can be crafted. It lets you get away with as much as possible.
It should be readily available on most package managers, atleast debian based last time I checked.
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#6The linked page says "High level != inefficient" and shows an example program which will print "every TCP packet".
With no "if" anywhere in the code, I wondered how it knew to print only TCP packets and not others. And the answer turns out to be that it throws a C++ exception on every non-TCP packet!
If most of the packets on your network are TCP, this is sort of OK. But if you have mostly non-TCP packets, this toy program costs about 10x the CPU utilization that it would if it used "if" instead of magic.
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#7Also check out packit[1] a command line packet crafter. It is very easy to use once you really understand how to use it. Also it has no 'restrictions' on what packets can be crafted. It lets you get away with as much as possible. It should be readily available on most package managers, atleast debian based last time I checked. [1]: http://packetfactory.openwall.net/projects/packit/
The active version appears to be hosted here:
https://github.com/eribertomota/packit
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#8>Note: the scapy benchmarks look like it takes almost the same time as the impacket ones, but it actually doesn't. In fact, it takes so much time that the maximum Y-axis value had to be restricted. Otherwise the rest of the bars couldn't almost be seen. If you hover over each bar, you will see the actual times in seconds. wow, they weren't kidding. In the first and the last graph, scapy is ten times slower than the n…
Well, scapy's code is not of the highest quality - it still uses os.popen and calls tcpdump:
https://github.com/secdev/scapy/blob/728177bff883f170e9ac004...
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#9The linked page says "High level != inefficient" and shows an example program which will print "every TCP packet". With no "if" anywhere in the code, I wondered how it knew to print only TCP packets and not others. And the answer turns out to be that it throws a C++ exception on every non-TCP packet! If most of the packets on your network are TCP, this is sort of OK. But if you have mostly non-TCP packets, this toy p…
There are plenty of ways they can keep the current API while eventually approaching optimal, for example, a chain of exceptions could incrementally refine the framework's idea of what the callback function expects, which could be turned into a BPF filter.
So for the cost of a few expensive frames at start, afterwards no exceptions get thrown.
Generally speaking though, I'm only replying because I hate people negging on minutia of new projects. If you're going to be critical of something especially when it's a lone wolf effort (or even a small team), try to be constructive, there are real people on the other end of the wire.
Re: Libtins – High-level and multiplatform C++ network packet sniffing and crafting
#10If anybody is interested I wrote a zero-copy socket wrapper in golang it's pretty fast and has built in layer detection and checksum functions: