As part of a broader organisational restructure, data networking research at Swinburne University of Technology has moved from the Centre for Advanced Internet Architecture (CAIA) to the Internet For Things (I4T) Research Lab.

Although CAIA no longer exists, this website reflects CAIA's activities and outputs between March 2002 and February 2017, and is being maintained as a service to the broader data networking research community.

NetSniff

Code Structure - Overview

The hierarchical layout allows a packet header to be processed for information by a single class which then decides whether to pass the enclosed payload to another class for processing. Netsniff works slightly differently with stream based protocols such as TCP Streams. Netsniff uses a TCPStream instance to reconstruct an entire TCP Stream - gathering TCP level statistics in the process - and passing the TCP bit-stream to an application level parser for further processing. Captured packets are processed both at the packet level and at the stream level where appropriate.

Current implementation of packet level processing is indicated in Figure 1, where an arrow indicates what packet types are currently checked for within a particular packet type.The PCAPDev class is not a packet in it its own right, but contains the function called by the pcap library and creates the first instance of the packet class used to process the captured data.

Figure 1. Collaboration diagram of packet classes

Example of parsing an ICMP Packet

An ICMP packet is captured on an Ethernet device:

1. The PCAPDev class constructs an EtherPacket instance.
2. The EtherPacket instance processes the Ethernet headers and constructs an IPPacket instance.
3. The IPPacket instance processes the IP header and constructs an ICMPPacket instance.
4. The ICMPPacket instance processes the payload of the ICMP Packet.

This class-based design allows for parsing of ICMP packets over a variety of different underlaying protocols as long as their parsers are complete.

Figure 2. Stream level protocols

Physical and link-layer protocol implementation

The run-time procedure is for the packet headers and payload to be parsed in the main Packet class and subsequent constructors which store information in their member variables. Once the captured information has been parsed, the Output() method on the main Packet class is automatically called with the correct output stream to output all stored information, the Output() method on any encapsulated packets is also called, so that all processed packet information is output.

Packet-based application layer protocol implementation

• All information contained within the packet payload must be processed or copied by the class constructor as the memory allocated to the payload will be freed once the constructor terminates.
• The DumpFileName() method should be overloaded to return the file name to dump packet information to. An output grammar specifies the data to be
• The Output() method should be overloaded to output the stored payload information. All data logged by encapsulating packets (eg. IP Layer) will be automatically output prior to the application layer Output() method being called.
• If necessary, the boolean OmmitOutputFromParent() method allows exclusion of the encapsulating packets output.

Stream-based application layer protocol implementation

Each parser is implemented in a class subclassed from the APPParser class. Port numbers for the application are registered in APPParserFactory. Data from the TCP bitstream is collected a portion at a time, the parser must be able to process this data in blocks as it is provided. The proceedure is:

• The underlying TCPStream class reconstructs the bitstream in the correct order and passes portions to the parser via the ParseClient() and ParseServer() methods. The parser processes these data blocks for any relevant information and stores it for later output.
• The parser must honour the global anonymisation flag to anonymise data if required.
• The boolean Parsed() method should return whether the TCP Stream is parsed or not (allowing non-parsed streams to be logged in the notparsed.dump file.
• The DumpFileName() method should return the file name to dump all logged information to.
• The Output() method is overloaded to output the stored information. Prepended to this output (for each individual TCP stream) is the TCP Stream statistics logged while the TCP bitstream was reconstructed.
• The static Create() method is called by the APPParserFactory to dynamically create an instance of the required parser.

Anonymisation tools implementation

• IP Address Anonymisation - The IPAddressMap class anonymises addresses using a similar algorithm to that used by tcpdcriv running with the -A 50 flag. The class maintains a map of seen IP addresses to anonymised IP adresses so that the same IP address will be mapped to the same anonymised IP address. This algorithm also maintains network locality information between two IP addresses in their anonymised forms.
• String Hashing - Strings are anonymised using a secure hash with a random key (which is regenerated for each run of netsniff). The output of the string anonymisation is a hex string which uniquely represents the original input string. Comparison of similar input strings is not possible since the hash function has the required property of equally dispersing strings in the input-space into the output-space.

More Information