Re: New target to control a fake network interface

[Kenneth Porter <shiva@sewingwitch.com>]

--On Tuesday, June 21, 2005 2:12 AM +0000 Corey Giovanella 
<coreygiovanella@challenge-engineering.com> wrote:

> I've posted the source and perhaps a better description on my web site:
> http://challenge-engineering.com/~corey/projects/fake_if/

You're echoing iptables packet counts into a fake interface to make it 
available to an existing graphical monitor application. The app has a 
plugin system, so wouldn't it be better to write an iptables plugin for it? 
What's the advantage of copying the counters to another kernel object?

The fake interface is an interesting object but maybe not the best solution 
for this particular problem.

Given a general iptables plugin, this would make a good replacement for 
ntop as a packet-counting protocol analyzer. I find ntop (which uses 
libpcap) a bit "heavyweight" for just counting packets, as it also does 
deep analysis of their content and hence uses a fair amount of memory and 
CPU. (ntop also exposes the data via web interface, which is nice for 
non-Linux clients.)