Mashd Labs

PikeFlows project renamed Culvert.

[ Posted by James Harton Tue, 04 Aug 2009 04:03:00 GMT ]

Mainly because I liked it better. GitHub project page.

Posted in Projects, Meta, Culvert, Pike | Tags culvert, rename | no comments

PikeFlows updated to Pike 7.8 (much faster too!)

[ Posted by James Harton Mon, 03 Aug 2009 02:11:35 GMT ]

I've spent the last wee while hacking on PikeFlows to fix some of the locking issues present in the initial version. I've made use of Pike 7.8's new getter/setter syntax to give much finer grained locking, meaning that it now runs faster because it's locking each object only for a single atomic transaction.

There are still some unusual behaviours using Public.Network.Pcap (it seems to randomly capture packets on Mac OS X for example), however appears to be working nicely on Linux.

I've rewritten the demo app flow.pike to take command line options, check the top of the file for more information.

Check out the latest source from GitHub.

Posted in Projects, Culvert, Pike | Tags flow, linux, locking, mutex, osx, pike, pike7.8 | 1 comment

PikeFlows: Pike IP packet flow analysis

[ Posted by James Harton Tue, 19 May 2009 00:48:42 GMT ]

Around the end of last year I wrote a IP and IPv6 flow handler in Pike for some packet analysis I wanted to do.

The code is available here under the GNU LGPL.

It's simple to use, and there is a demonstration app which simply keeps track of all your flows and periodically prints out all your active connections:

Just take a look at flow.pike in the archive. The important part being void capture_cb(). It takes the packet from libpcap and explodes it with the Ethernet.Frame module, it then takes a look at the frame type. It passes IP packets to either IP.v4.Packet or IP.v6.Packet and then on to IP.Flow.Engine for processing into a flow. Something I threw in to show how easy it is to work with is de-encapsulation of 6to4 packets from within IPv4 packets.

I should write some documentation, but in the mean time just email me if you have questions. Thanks to Bill for Public.Network.Pcap.

Posted in Projects, Culvert, Pike | Tags analysis, flow, ip, ipv4, ipv6, packets, pcap, pike, state | no comments