Skip to content

FromDevice.u

Jump to bottom Edit New page
Tom Barbette edited this page May 7, 2020 · 3 revisions

FromDevice.u Element Documentation

NAME

FromDevice.u — Click element; reads packets from network device (user-level)

SYNOPSIS

FromDevice(DEVNAME [, keywords SNIFFER, PROMISC, FORCE_IP, etc.])

Batching: Batching natively supported
Ports: no inputs, 1-2 outputs
Processing: push
Drivers: userlevel

DESCRIPTION

This manual page describes the user-level version of the FromDevice element. For the Linux kernel module element, read the FromDevice manual page.

Reads packets from the kernel that were received on the network controller named DEVNAME.

User-level FromDevice behaves like a packet sniffer by default. Packets emitted by FromDevice are also received and processed by the kernel. Thus, it doesn't usually make sense to run a router with user-level Click, since each packet will get processed twice (once by Click, once by the kernel). Install firewalling rules in your kernel if you want to prevent this, for instance using the KernelFilter element or FromDevice's SNIFFER false argument.

Under Linux, a FromDevice element will not receive packets sent by a ToDevice element for the same device. Under other operating systems, your mileage may vary.

Sets the packet type annotation appropriately. Also sets the timestamp annotation to the time the kernel reports that the packet was received.

Keyword arguments are:

  • SNIFFER — Boolean. Specifies whether FromDevice should run in sniffer mode. In non-sniffer mode, FromDevice installs KernelFilter filtering rules to block the kernel from handling any packets arriving on device DEVNAME. Default is true (sniffer mode).
  • PROMISC — Boolean. FromDevice puts the device in promiscuous mode if PROMISC is true. The default is false.
  • SNAPLEN — Unsigned. On some systems, packets larger than SNAPLEN will be truncated. Defaults to 2046.
  • FORCE_IP — Boolean. If true, then output only IP packets. (Any link-level header remains, but the IP header annotation has been set appropriately.) Default is false.
  • METHOD — Word. Defines the capture method FromDevice will use to read packets from the device. Linux targets generally support PCAP and LINUX; other targets support only PCAP. Defaults to PCAP.
  • BPF_FILTER — String. A BPF filter expression used to select the interesting packets. Default is the empty string, which means all packets. If METHOD is not PCAP, then any filter expression is ignored with a warning.
  • ENCAP — Word. The encapsulation type the interface should use; see FromDump for choices. Ignored if METHOD is not PCAP.
  • OUTBOUND — Boolean. If true, then emit packets that the kernel sends to the given interface, as well as packets that the kernel receives from it. Default is false.
  • PROTOCOL — Integer. If set and nonzero, then only emit packets with this link-level protocol. Only affects METHOD LINUX. Default is 0.
  • HEADROOM — Integer. Amount of bytes of headroom to leave before the packet data. Defaults to roughly 28.
  • BURST — Integer. Maximum number of packets to read per scheduling. Defaults to 1.
  • TIMESTAMP — Boolean. If false, then do not timestamp packets. Defaults to true.

EXAMPLES

  FromDevice(eth0) -> ...

NOTES

FromDevice sets packets' extra length annotations as appropriate.

ELEMENT HANDLERS

  • count (read-only) — Returns the number of packets read by the device.
  • reset_counts (write-only) — Resets "count" to zero.
  • kernel_drops (read-only) — Returns the number of packets dropped by the kernel, probably due to memory constraints, before FromDevice could get them. This may be an integer; the notation "<d", meaning at most d drops; or "??", meaning the number of drops is not known.
  • encap (read-only) — Returns a string indicating the encapsulation type on this link. Can be `IP', `ETHER', or `FDDI', for example.

SEE ALSO

ToDevice.u, FromDump, ToDump, KernelFilter, FromDevice

Generated by click-elem2man from ../elements/userlevel/fromdevice.hh:30 on 2020/05/07.

Add a custom footer
Clone this wiki locally