Using libpcap/Jpcap to capture and send packets on Solaris - Part 1

AID: 8193
  • Status: Published

1410 points

  • By2sbsbsb
  • TypeTutorial
  • Posted on2011-10-13 at 09:39:16
Using libpcap/Jpcap to capture and send packets on Solaris version (10/11)

Library used:
1.      Libpcap (http://www.tcpdump.org) Version 1.2
2.      Jpcap(http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html) Version 0.6
Prerequisite:
1.      GCC
2.      Make

Notes:
1. Verify if these software’s are installed by writing #gcc and #make at the command prompt.
2.  See appendix to install these software.
Libpcap (version 1.2)

Installation
Download libpcap-1.2.0.tar.gz from http://www.tcpdump.org/#latest-release 
# gunzip libpcap-1.2.0rc1.tar.gz
                                    
1:

Select allOpen in new window


# tar xf libpcap-1.2.0rc1.tar
                                    
1:

Select allOpen in new window


# cd libpcap-1.2.0
                                    
1:

Select allOpen in new window


Configure it for your OS, few files will be generated
# ./configure  
                                    
1:

Select allOpen in new window



Specific to Solaris 11 - Start

This section (Marked in italcs) can be skipped if OS is solaris 10.
In case of Solaris 11 the configuration doesn’t work properly so do the following.

1.      config.h
Replace the following line
/* define if you have a cloning BPF device */
#define HAVE_CLONING_BPF 1
With
/* define if you have a cloning BPF device */
/* #undef HAVE_CLONING_BPF */
Replace the following line
/* #undef HAVE_DLPI_PASSIVE */
With
#define HAVE_DLPI_PASSIVE 1

Replace the following line
/* Define to 1 if you have the <netpacket/packet.h> header file. */
#define HAVE_NETPACKET_PACKET_H 1
With
/* Define to 1 if you have the <netpacket/packet.h> header file. */
/* #undef HAVE_NETPACKET_PACKET_H */


Replace the following line
/* Define to 1 if you have the <sys/bufmod.h> header file. */
/* #undef HAVE_SYS_BUFMOD_H */
With
/* Define to 1 if you have the <sys/bufmod.h> header file. */
#define HAVE_SYS_BUFMOD_H 1

2. MakeFile
Replace
INSTALL = /usr/bin/ginstall –c
With
INSTALL = ./install-sh -c
Replace the following lines
PSRC =      pcap-bpf.c    
FSRC =  fad-getad.c
SSRC =  
With
PSRC =      pcap-dlpi.c    
FSRC =  fad-glifc.c
SSRC =  dlpisubs.c
Specific to Solaris 11 - End


#make 
                                    
1:

Select allOpen in new window



Upgrade or Update

If libpcap is already installed, then uninstall it before re-installing.

#make uninstall 
#make distclean 
                                    
1:
2:

Select allOpen in new window

New Installation

#make install 
                                    
1:

Select allOpen in new window



Verify if libpcap is correctly installed by running some sample tests.

# make tests
                                    
1:

Select allOpen in new window



Findalldevtest list all network interface device.
# ./findalldevstest 
                                    
1:

Select allOpen in new window


NonBlocktest will start listening to the first network interface device. 
# ./nonblocktest
                                    
1:

Select allOpen in new window



Verify that the shared object file is created and installed. 

# find /usr -name libpcap.so   
/usr/local/lib/libpcap.so
                                    
1:
2:

Select allOpen in new window

Set LD_LIBRARY_PATH (Jpcap will link this shared object)

# echo LD_LIBRARY_PATH
                                    
1:
2:
3:

Select allOpen in new window



Setting the library path (Path were libpcap.so is present) 
# LD_LIBRARY_PATH=/usr/local/lib/
# export LD_LIBRARY_PATH
                                    
1:
2:

Select allOpen in new window



Exercise:

1.      Write a program to capture packets for a given network interface card.
2.      Write a program to broadcast packets through a given network interface card.
3.      Verify packets using snoop –d <NetworkInterfaceName> command.

Common Errors:
1.      Check LD_LIBRARY_PATH It should be set to where shared library is installed.


JPCap

Jpcap is a Java library for capturing and sending network packets. It internally uses libpcap/winpcap.

Installation
Download jpcap-0.6.zip (http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/download.html) 
# unzip jpcap-0.6.zip 
#cd src/c 
#make 
                                    
1:
2:
3:

Select allOpen in new window



You can observe lots of errors, so lets configure Makefile.  Set JAVA_HOME to correct path 

# vi Makefile
                                    
1:

Select allOpen in new window



Correct Option: Uncomment the following lines and comment out the respective other lines. 

1.	JAVA_DIR = $(JAVA_HOME) 
2.	JNI_INCLUDE2 = $(JAVA_DIR)/include/solaris
3.	PCAP_INCLUDE = /usr/local/include/pcap
4.	COMPILE_OPTION = -G
                                    
1:
2:
3:
4:

Select allOpen in new window



Save this file and again execute make
#make
                                    
1:

Select allOpen in new window



It will still have few more errors in Jpcap.c file.
#vi Jpcap.c 
                                    
1:

Select allOpen in new window



Changes:

Solaris 10 and Solaris 11

1.      Replace the word “ifr.ifr_ifrn.ifrn_name” with “ifr.ifr_name”
2.      Replace the word “ifr.ifr_ifru.ifru_hwaddr.sa_data” with “ifr.ifr_ifru.ifru_enaddr”

Solaris 10 only 

3.	#define SIOCGIFHWADDR  SIOCGIFADDR  
                                    
1:

Select allOpen in new window




Post making these changes it will generate libjpcap.so file. 

# make 
                                    
1:

Select allOpen in new window


Move the shared library to /usr/local/lib 
#cp libjpcap.so /usr/local/lib/
                                    
1:

Select allOpen in new window



Verify that LD_LIBRARY_PATH is already set to /usr/local/lib.
#echo $LD_LIBRARY_PATH
                                    
1:

Select allOpen in new window



Compile all the programs in sample directory and verify running each of them.

Exercise:

1.      Write a program to capture packets for a given network interface card using Jpcap.
2.      Write a program to broadcast packets through a given network interface card using jpcap.


Appendix:

Installation of Make and GCC

GCC
Verify if gcc is already installed 
#find /usr -name gcc 
                                    
1:

Select allOpen in new window


If it is not installed 
#pkg install gcc-3
                                    
1:

Select allOpen in new window



Append it to the path (Ex: /usr/sfw/bin)

#PATH=$PATH:/usr/sfw/bin
                                    
1:

Select allOpen in new window



Make
Verify if make is already installed 

# find /usr -name make
                                    
1:

Select allOpen in new window



Append it to the path (Ex:/usr/ccs/bin)

# PATH=$PATH:/usr/ccs/bin
#echo $PATH and verify if gcc and make path are visible. 
                                    
1:
2:

Select allOpen in new window

Asked On
2011-10-13 at 09:39:16ID8193
Tags

Jpcap Libpcap network packets ethernet

Topic

Sun Solaris

Views
869

About The Author

2sbsbsb

2sbsbsb has more than 10 years of experience as developer  in financial domain. He has mostly worked on java and related technology. He is SUN and Microsoft certified developer.

More Articles From 2sbsbsb

Comments

Author Comment

by: 2sbsbsb on 2011-10-17 at 10:14:52ID: 32576
There were lots of questions floating around in various forums revolving around installation of libpcap / jpcap. The software is well documented for OS like Linux and windows, but no documentation for solaris and the Google was not enough so here is my attempt to provide installation guide for both libpcap and jpcap on solaris in particular.

In this article which is Part 1 is an installation guide with few exercise. In Part 2 of this article i will discuss Ethernet frame, packet capture/send over Ethernet with examples

Please feel free to ask any questions based on this article or in general issues regarding libpcap/jpcap. I would also appreciate comments by subject area experts in these software.  

Add your Comment

Please Sign up or Log in to comment on this article.

Join Experts Exchange Today

Gain Access to all our Tech Resources

Get personalized answers

Ask unlimited questions

Access Proven Solutions

Search 3.2 million solutions

Read In-Depth How-To Guides

1000+ articles, demos, & tips

Watch Step by Step Tutorials

Learn direct from top tech pros

And Much More!

Your complete tech resource

See Plans and Pricing

30-day free trial. Register in 60 seconds.

Loading Advertisement...

Top Solaris Unix Experts

  1. blu

    11,550

    0 points yesterday

    Profile
    Rank: Sage

  2. woolmilkporc

    7,000

    0 points yesterday

    Profile
    Rank: Genius

  3. ganjos

    6,960

    0 points yesterday

    Profile
    Rank: Guru

  4. arnold

    6,300

    0 points yesterday

    Profile
    Rank: Genius

  5. gerwinjansen

    4,000

    0 points yesterday

    Profile
    Rank: Sage

  6. mrjoltcola

    2,800

    0 points yesterday

    Profile
    Rank: Genius

  7. Tintin

    2,000

    0 points yesterday

    Profile
    Rank: Genius

  8. bummerlord

    2,000

    0 points yesterday

    Profile
    Rank: Master

  9. gheist

    2,000

    0 points yesterday

    Profile
    Rank: Genius

  10. Jacobfw

    2,000

    0 points yesterday

    Profile
    Rank: Master

  11. solarisadmin7

    2,000

    0 points yesterday

    Profile

  12. advega

    1,500

    0 points yesterday

    Profile

  13. yuzh

    1,000

    0 points yesterday

    Profile
    Rank: Genius

  14. amolg

    1,000

    0 points yesterday

    Profile
    Rank: Guru

  15. Anacreo

    1,000

    0 points yesterday

    Profile

  16. oklit

    1,000

    0 points yesterday

    Profile
    Rank: Genius

  17. hossamshaaban

    1,000

    0 points yesterday

    Profile
    Rank: Master

  18. masax

    1,000

    0 points yesterday

    Profile

  19. Manjitk

    1,000

    0 points yesterday

    Profile

  20. 2sbsbsb

    730

    0 points yesterday

    Profile

  21. Laruso21

    500

    0 points yesterday

    Profile

  22. serialband

    200

    0 points yesterday

    Profile
    Rank: Master

Hall Of Fame