hippie-users Mailing List for HiPPIE
Brought to you by:
baldown
Menu
▾
▴
hippie-users — This list is to supplement communication amongst the community of HiPPIE users.
You can subscribe to this list here.
| 2008 |
Jan
|
Feb
(2) |
Mar
(2) |
Apr
(5) |
May
|
Jun
(1) |
Jul
|
Aug
|
Sep
|
Oct
(4) |
Nov
(1) |
Dec
(7) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2009 |
Jan
(1) |
Feb
|
Mar
(1) |
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2010 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(3) |
Oct
|
Nov
|
Dec
|
|
From: Greg O. <oli...@gm...> - 2010-09-14 22:25:03
|
On Tue, Sep 14, 2010 at 4:51 PM, seba hauret <ha...@ho...> wrote: > > greg, > > I do not know too deep how HIPPIE works, but I couldn't see any place where > says that it could recognise RTP. > The problem of Hippie is that it is a little complicate to make a pattern of > a new protocol and if I remember well you have to recompile the kernel after > you add a new pattern. > What you mean with "active" mode? You want to use it in the middle of the > traffic? > You can do it using iptables/netfilter rules. You use Hippie to recognise > the traffic and then you can make decisions using iptables. > > I know better L7-filter or ntop. L7 filter have some problems to detect RTP > because the pattern that it use is very general but if you use conntrack > (conntrack_sip or conntrack_h323) it detect almost all the RTP and SIP > packets with no error. The problem is that it assign all of them like SIP. > I do not know exactly how you want to define if you accept or deny the > packets but i almost sure that Iptables with L7filter can do what you want. > The filter I am using for l7-filter is more precise that the generic rtp filter since it is looking directly at the payload type. The classifications and all are generally working there, but glibc is crashing all of the time. I am in the process of rebuilding the userspace on that box to see if I can fix it. I was unsure of HiPPIE's capabilities since the docs were mentioned to be a bit behind, so I just thought I would ask. Thanks! > >> Date: Tue, 14 Sep 2010 16:12:54 -0500 >> From: oli...@gm... >> To: hip...@li... >> Subject: [HiPPIE-Users] A couple of general question >> >> Hi, >> >> I have been *trying* to use l7-filters for my purposes, but it keeps >> crashing on me, so I am exploring alternatives. I ran across HiPPIE, >> and while it seemed promising, I just need to verify a couple of >> things. >> >> o Does the *active* mode work? I could not find any docs on it. >> >> o Is RTP supported in any way? I see rtsp is, but they are not >> nearly the same thing as far as packet composition goes. I need to >> grab the payload type from RTP packets and either drop or allow >> depending on what it is. >> >> Can HiPPIE do this? >> >> Thanks >> >> -Greg >> >> >> ------------------------------------------------------------------------------ >> Start uncovering the many advantages of virtual appliances >> and start using them to simplify application deployment and >> accelerate your shift to cloud computing. >> http://p.sf.net/sfu/novell-sfdev2dev >> _______________________________________________ >> HiPPIE-Users mailing list >> HiP...@li... >> https://lists.sourceforge.net/lists/listinfo/hippie-users > |
|
From: seba h. <ha...@ho...> - 2010-09-14 21:51:34
|
greg, I do not know too deep how HIPPIE works, but I couldn't see any place where says that it could recognise RTP. The problem of Hippie is that it is a little complicate to make a pattern of a new protocol and if I remember well you have to recompile the kernel after you add a new pattern. What you mean with "active" mode? You want to use it in the middle of the traffic? You can do it using iptables/netfilter rules. You use Hippie to recognise the traffic and then you can make decisions using iptables. I know better L7-filter or ntop. L7 filter have some problems to detect RTP because the pattern that it use is very general but if you use conntrack (conntrack_sip or conntrack_h323) it detect almost all the RTP and SIP packets with no error. The problem is that it assign all of them like SIP. I do not know exactly how you want to define if you accept or deny the packets but i almost sure that Iptables with L7filter can do what you want. Bye Seba > Date: Tue, 14 Sep 2010 16:12:54 -0500 > From: oli...@gm... > To: hip...@li... > Subject: [HiPPIE-Users] A couple of general question > > Hi, > > I have been *trying* to use l7-filters for my purposes, but it keeps > crashing on me, so I am exploring alternatives. I ran across HiPPIE, > and while it seemed promising, I just need to verify a couple of > things. > > o Does the *active* mode work? I could not find any docs on it. > > o Is RTP supported in any way? I see rtsp is, but they are not > nearly the same thing as far as packet composition goes. I need to > grab the payload type from RTP packets and either drop or allow > depending on what it is. > > Can HiPPIE do this? > > Thanks > > -Greg > > ------------------------------------------------------------------------------ > Start uncovering the many advantages of virtual appliances > and start using them to simplify application deployment and > accelerate your shift to cloud computing. > http://p.sf.net/sfu/novell-sfdev2dev > _______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users |
|
From: Greg O. <oli...@gm...> - 2010-09-14 21:13:03
|
Hi, I have been *trying* to use l7-filters for my purposes, but it keeps crashing on me, so I am exploring alternatives. I ran across HiPPIE, and while it seemed promising, I just need to verify a couple of things. o Does the *active* mode work? I could not find any docs on it. o Is RTP supported in any way? I see rtsp is, but they are not nearly the same thing as far as packet composition goes. I need to grab the payload type from RTP packets and either drop or allow depending on what it is. Can HiPPIE do this? Thanks -Greg |
|
From: Theresa.Enghardt <s0...@hf...> - 2009-11-22 13:00:19
|
Hello, my passive implementation of HiPPIE is working just fine. Now I am interested in deploying active in order to mark certain packets that have been matched. I would like to use the Netfilter Plugin, but it is currently not documented. How do I set up the iptables for HiPPIE to match my packets? Thank you in advance. Theresa |
|
From: Marc W. <mar...@gm...> - 2009-04-10 10:55:05
|
Hi, Have I got the information correctly from the home page that the only way using hippie is patching the kernel? I've setup traffic shaping on my v-server shape the down stream which seems to work fine. However I'm still looking for a way to distinguish http downloads (larger files) from http browsing traffic. matching a big package size seems to work reosanable.. But maybe there is even a better way ? So in this case I'd like to parse the http header fields to look at the length value. If it exceeds a limit slow down the stream (until a small file (eg html file) is requested again). So this requires kind of state. I think hippie has been made for this? Does HiPPIE work well in xen guest kernels? Has anyone thought about creating some kind of business out of this? I mean a lot of people do have slow browsing experiences because Win is downloading a service pack or such. Installing and configuring a vpn is dead simple routing all the traffic through a shaper. Only people having slow connections are interested in general. So there would'nt be too much unpredictable loads on the server either ? Sincerly Marc Weber |
|
From: perlish <pe...@gm...> - 2009-03-12 01:04:30
|
Hi list:
I've got the following result about socks protocol,and I open the
DEBUG option when config the kernel,but I can not find anything about socks
in the syslog.
How can I get the log info about socks,such as src ip and port,dst ip and
port, thanks a lot !
Protocol Name: socks
Persistance: Off
Signature N-Packets Value: 10
[ Classifications ]
Classified Connections: 8
Classified Packets: 283
Classified Bytes: 179405
[ Encapsulations ]
Encapsulated Connections: 8
Encapsulated Packets: 283
Encapsulated Bytes: 179405
Inspected Packets: 0
Predictions Made: 0
Predictions Used: 0
|
|
From: Trivedi, N. <ntr...@mi...> - 2009-01-29 18:09:42
|
Assuming we have Hippie loaded on a server with multiple Ethernet interfaces, is it possible to obtain unique stats broken down based on the incoming interface? I'm looking for a separate set of stats for each enabled interface. If such a function does not exist, how difficult might it be to implement in a subsequent release? Thanks. -Nirav |
|
From: Josh B. <jo...@oo...> - 2008-12-17 19:38:26
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey Nirav, Thanks for your mail. I'd be glad to expound a bit on how HiPPIE functions processing packets and classifying protocols. Basically, instead of relying on something like regular expressions and their limitations, HiPPIE uses "functional signatures," in that each packet is actually processed by a function within the protocol classifiers to deteremine whether the packet contains that protocol or not. So, ultimately, that function could contain anything. It could contain a simple string search/check to look for certain bytes indicative of certain protocols, or do more complex things like compare sizes of packets against size indicators within the packet, check for certain opcodes that go with certain protocols, and so forth. Basically, the sky is pretty much the limit. Ultimately, to answer the question for how a certain protocol is classified, you'd actually have to look at that protocols module to find out, and those are available under your kernel source under net/hippie/proto/. Let me know if you have any more questions, and I'd be glad to answer. Thanks Josh On Dec 17, 2008, at 1:12 PM, Trivedi, Nirav wrote: > Josh, > I had a very basic question about how HIPPIE performs > classification. It’s going beyond performing a simple Regular > Expression match for protocol signatures on packets (as is done with > L7 filter), but I’m not clear as to what the actual algorithm > entails. Could you perhaps provide a brief description? I would > like to understand the full benefit of HIPPIE’s approach. Thanks. > > -Nirav > ------------------------------------------------------------------------------ > SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, > Nevada. > The future of the web can't happen without you. Join us at MIX09 to > help > pave the way to the Next Web now. Learn more and register at > http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/_______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAklJVRQACgkQYj4wn+b+JWZsswCgkeL17qNflMFaVmtOOuAy6ucx 6UsAn35ev7+HEtr0EEVytUTDO7Dbt+YI =GFWM -----END PGP SIGNATURE----- |
|
From: Trivedi, N. <ntr...@mi...> - 2008-12-17 19:12:45
|
Josh, I had a very basic question about how HIPPIE performs classification. It's going beyond performing a simple Regular Expression match for protocol signatures on packets (as is done with L7 filter), but I'm not clear as to what the actual algorithm entails. Could you perhaps provide a brief description? I would like to understand the full benefit of HIPPIE's approach. Thanks. -Nirav |
|
From: Trivedi, N. <ntr...@mi...> - 2008-12-09 22:34:30
|
Thanks Josh. Just verified that the stat_reset works as advertised. -Nirav -----Original Message----- From: Josh Ballard [mailto:jo...@oo...] Sent: Saturday, December 06, 2008 10:36 PM To: hip...@li... Subject: Re: [HiPPIE-Users] How to clear stats? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Nirav, I just wanted to let you, and anyone else, know that I just released a new minor-revision update to HiPPIE, 0.9.1.1. I've fixed it up to patch against the latest kernels (2.6.27.8) and in addition, decided while I was checking on things to quickly implement /proc/net/hippie/ stat_reset, which when a numerical value is echo'd into it as root, will reset all counters on HiPPIE. It doesn't clear the session table, though this is something I might consider adding to it later. This is helpful for something I was working on elsewhere, and I'm hoping will be helpful for you as well. Let me know if you run into any issues with it, as I didn't heavily test it, but at least verified that it did what I expected. The new version is available through SourceForge from the download page at http://hippie.oofle.com/ download. Thanks Josh On Dec 3, 2008, at 2:12 PM, Trivedi, Nirav wrote: > Thanks Josh, where would I find the types and the related counters to > reset to 0? > Nice idea about using a virtual machine and a tun interface. I'll > give > it a shot. > > -Nirav > > > -----Original Message----- > From: Josh Ballard [mailto:jo...@oo...] > Sent: Wednesday, December 03, 2008 2:09 PM > To: hip...@li... > Subject: Re: [HiPPIE-Users] How to clear stats? > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hey Nirav, > Actually, there's nothing programmed in currently, but it > wouldn't be > too difficult to implement if someone wanted to take it on. I wish > I'd had more time to do some work on HiPPIE lately, but things have > been immensely busy. All you'd have to do is set up another proc > interface in HiPPIE called reset or something, and any time you echo 1 > > into it, it loops all the types and resets the counters for each back > to 0. > Also, if you're interested, I think you might be trying to > attempt > something that I've already done before in another method. One thing > you might look at is standing up a virtual machine with a virtual > interface mapped to a tun interface, and playing your packets back > into the tun interface. Either way, your way might be easiest from > scratch, but that was one way I've attempted to do automated analysis > before. Hopefully that helps. Thanks > > Josh > > On Dec 3, 2008, at 12:00 PM, Trivedi, Nirav wrote: > >> Hi, I have a quick question. How do you clear the /proc/net/hippie/ >> protocols and /proc/net/hippie/stats ? I'd like to be able send a >> stream of data to HIPPIE in passive mode, get back statistics, clear > >> all data from the first stream, and then send the next stream and so > >> on. >> Thanks. >> >> >> >> > ----------------------------------------------------------------------- > -- >> This SF.Net email is sponsored by the Moblin Your Move Developer's >> challenge >> Build the coolest Linux based applications with Moblin SDK & win >> great prizes >> Grand prize is a trip for two to an Open Source event anywhere in >> the world >> > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > _____________ > __________________________________ >> HiPPIE-Users mailing list >> HiP...@li... >> https://lists.sourceforge.net/lists/listinfo/hippie-users > > -----BEGIN PGP SIGNATURE----- > > iEYEARECAAYFAkk22WEACgkQYj4wn+b+JWbEpACfUM50WsKbzZn+8b9q33SDUm3r > SBwAoJRL+GG5CLENugssA1zSz6eEAD5a > =cYuw > -----END PGP SIGNATURE----- > > ----------------------------------------------------------------------- > -- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win great > prizes > Grand prize is a trip for two to an Open Source event anywhere in the > world > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > _______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users > > ------------------------------------------------------------------------- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win > great prizes > Grand prize is a trip for two to an Open Source event anywhere in > the world > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > _______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkk7RKQACgkQYj4wn+b+JWbd+ACffVVNNOzN7ia316oNxi8qrVsE IIsAn1XYn0g1vc0sQmCFaOyK/NYWVTsZ =Z6u4 -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada. The future of the web can't happen without you. Join us at MIX09 to help pave the way to the Next Web now. Learn more and register at http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/ _______________________________________________ HiPPIE-Users mailing list HiP...@li... https://lists.sourceforge.net/lists/listinfo/hippie-users |
|
From: Josh B. <jo...@oo...> - 2008-12-07 03:56:26
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Nirav, I just wanted to let you, and anyone else, know that I just released a new minor-revision update to HiPPIE, 0.9.1.1. I've fixed it up to patch against the latest kernels (2.6.27.8) and in addition, decided while I was checking on things to quickly implement /proc/net/hippie/ stat_reset, which when a numerical value is echo'd into it as root, will reset all counters on HiPPIE. It doesn't clear the session table, though this is something I might consider adding to it later. This is helpful for something I was working on elsewhere, and I'm hoping will be helpful for you as well. Let me know if you run into any issues with it, as I didn't heavily test it, but at least verified that it did what I expected. The new version is available through SourceForge from the download page at http://hippie.oofle.com/ download. Thanks Josh On Dec 3, 2008, at 2:12 PM, Trivedi, Nirav wrote: > Thanks Josh, where would I find the types and the related counters to > reset to 0? > Nice idea about using a virtual machine and a tun interface. I'll > give > it a shot. > > -Nirav > > > -----Original Message----- > From: Josh Ballard [mailto:jo...@oo...] > Sent: Wednesday, December 03, 2008 2:09 PM > To: hip...@li... > Subject: Re: [HiPPIE-Users] How to clear stats? > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hey Nirav, > Actually, there's nothing programmed in currently, but it > wouldn't be > too difficult to implement if someone wanted to take it on. I wish > I'd had more time to do some work on HiPPIE lately, but things have > been immensely busy. All you'd have to do is set up another proc > interface in HiPPIE called reset or something, and any time you echo 1 > > into it, it loops all the types and resets the counters for each back > to 0. > Also, if you're interested, I think you might be trying to > attempt > something that I've already done before in another method. One thing > you might look at is standing up a virtual machine with a virtual > interface mapped to a tun interface, and playing your packets back > into the tun interface. Either way, your way might be easiest from > scratch, but that was one way I've attempted to do automated analysis > before. Hopefully that helps. Thanks > > Josh > > On Dec 3, 2008, at 12:00 PM, Trivedi, Nirav wrote: > >> Hi, I have a quick question. How do you clear the /proc/net/hippie/ >> protocols and /proc/net/hippie/stats ? I'd like to be able send a >> stream of data to HIPPIE in passive mode, get back statistics, clear > >> all data from the first stream, and then send the next stream and so > >> on. >> Thanks. >> >> >> >> > ----------------------------------------------------------------------- > -- >> This SF.Net email is sponsored by the Moblin Your Move Developer's >> challenge >> Build the coolest Linux based applications with Moblin SDK & win >> great prizes >> Grand prize is a trip for two to an Open Source event anywhere in >> the world >> > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > _____________ > __________________________________ >> HiPPIE-Users mailing list >> HiP...@li... >> https://lists.sourceforge.net/lists/listinfo/hippie-users > > -----BEGIN PGP SIGNATURE----- > > iEYEARECAAYFAkk22WEACgkQYj4wn+b+JWbEpACfUM50WsKbzZn+8b9q33SDUm3r > SBwAoJRL+GG5CLENugssA1zSz6eEAD5a > =cYuw > -----END PGP SIGNATURE----- > > ----------------------------------------------------------------------- > -- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win great > prizes > Grand prize is a trip for two to an Open Source event anywhere in the > world > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > _______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users > > ------------------------------------------------------------------------- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win > great prizes > Grand prize is a trip for two to an Open Source event anywhere in > the world > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > _______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkk7RKQACgkQYj4wn+b+JWbd+ACffVVNNOzN7ia316oNxi8qrVsE IIsAn1XYn0g1vc0sQmCFaOyK/NYWVTsZ =Z6u4 -----END PGP SIGNATURE----- |
|
From: Trivedi, N. <ntr...@mi...> - 2008-12-03 20:12:47
|
Thanks Josh, where would I find the types and the related counters to reset to 0? Nice idea about using a virtual machine and a tun interface. I'll give it a shot. -Nirav -----Original Message----- From: Josh Ballard [mailto:jo...@oo...] Sent: Wednesday, December 03, 2008 2:09 PM To: hip...@li... Subject: Re: [HiPPIE-Users] How to clear stats? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey Nirav, Actually, there's nothing programmed in currently, but it wouldn't be too difficult to implement if someone wanted to take it on. I wish I'd had more time to do some work on HiPPIE lately, but things have been immensely busy. All you'd have to do is set up another proc interface in HiPPIE called reset or something, and any time you echo 1 into it, it loops all the types and resets the counters for each back to 0. Also, if you're interested, I think you might be trying to attempt something that I've already done before in another method. One thing you might look at is standing up a virtual machine with a virtual interface mapped to a tun interface, and playing your packets back into the tun interface. Either way, your way might be easiest from scratch, but that was one way I've attempted to do automated analysis before. Hopefully that helps. Thanks Josh On Dec 3, 2008, at 12:00 PM, Trivedi, Nirav wrote: > Hi, I have a quick question. How do you clear the /proc/net/hippie/ > protocols and /proc/net/hippie/stats ? I'd like to be able send a > stream of data to HIPPIE in passive mode, get back statistics, clear > all data from the first stream, and then send the next stream and so > on. > Thanks. > > > > ----------------------------------------------------------------------- -- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win > great prizes > Grand prize is a trip for two to an Open Source event anywhere in > the world > http://moblin-contest.org/redirect.php?banner_id=100&url=/_____________ __________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkk22WEACgkQYj4wn+b+JWbEpACfUM50WsKbzZn+8b9q33SDUm3r SBwAoJRL+GG5CLENugssA1zSz6eEAD5a =cYuw -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ HiPPIE-Users mailing list HiP...@li... https://lists.sourceforge.net/lists/listinfo/hippie-users |
|
From: Josh B. <jo...@oo...> - 2008-12-03 19:42:29
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey Nirav, Actually, there's nothing programmed in currently, but it wouldn't be too difficult to implement if someone wanted to take it on. I wish I'd had more time to do some work on HiPPIE lately, but things have been immensely busy. All you'd have to do is set up another proc interface in HiPPIE called reset or something, and any time you echo 1 into it, it loops all the types and resets the counters for each back to 0. Also, if you're interested, I think you might be trying to attempt something that I've already done before in another method. One thing you might look at is standing up a virtual machine with a virtual interface mapped to a tun interface, and playing your packets back into the tun interface. Either way, your way might be easiest from scratch, but that was one way I've attempted to do automated analysis before. Hopefully that helps. Thanks Josh On Dec 3, 2008, at 12:00 PM, Trivedi, Nirav wrote: > Hi, I have a quick question. How do you clear the /proc/net/hippie/ > protocols and /proc/net/hippie/stats ? I’d like to be able send a > stream of data to HIPPIE in passive mode, get back statistics, clear > all data from the first stream, and then send the next stream and so > on. > Thanks. > > > > ------------------------------------------------------------------------- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win > great prizes > Grand prize is a trip for two to an Open Source event anywhere in > the world > http://moblin-contest.org/redirect.php?banner_id=100&url=/_______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkk22WEACgkQYj4wn+b+JWbEpACfUM50WsKbzZn+8b9q33SDUm3r SBwAoJRL+GG5CLENugssA1zSz6eEAD5a =cYuw -----END PGP SIGNATURE----- |
|
From: Trivedi, N. <ntr...@mi...> - 2008-12-03 18:00:06
|
Hi, I have a quick question. How do you clear the /proc/net/hippie/protocols and /proc/net/hippie/stats ? I'd like to be able send a stream of data to HIPPIE in passive mode, get back statistics, clear all data from the first stream, and then send the next stream and so on. Thanks. |
|
From: Johann J. <Joh...@2n...> - 2008-11-14 16:14:52
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HI Josh and the list, which kernel version is the best testing hippie? I've still some compiling problems. Best Regards Johann -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkkdo/IACgkQyYH7lzNnCPs5agCgzk2Q1s32Qdji4GYaHuU6ZNhv hcAAn0XdmcVQY/5/VwR4DSK3l/UEKWjz =ZiPi -----END PGP SIGNATURE----- |
|
From: Johann J. <Joh...@2n...> - 2008-10-17 16:12:59
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Josh, i just read this: http://jengelh.medozas.de/documents/Netfilter_Modules.pdf and changed the names of the variables as follow: > #ifdef CONFIG_HIPPIE_NETFILTER_FEED > pie_packet_read((skb->data),(skb->len)); #endif it compiled fine against 2.6.25.10 I hope I'm now out of trouble! thanks Johann Josh Ballard schrieb: > Hey Johann, Your last mail to the list got bounced about me > compiling against 2.6.25.10. I guess that must be right. I'm > wondering if they updated 2.6.25.10 and it broke something. Let me > have a look later this afternoon still and I'll see what I can > figure out. Sorry for the inconvenience. The one thing you might > check is to make sure they didn't rename the skb variable to > something besides pskb in that function. I'll let you know what I > can find. Thanks Josh > > On Oct 17, 2008, at 7:27 AM, Johann Juraschek wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > >> Hi Josh and the List, > >> it just startet to compile the hippie on 2.6.25.10. > >> Actually der is one problem: > >>> CC net/netfilter/nf_conntrack_core.o >>> net/netfilter/nf_conntrack_core.c: In function >>> 'nf_conntrack_in': net/netfilter/nf_conntrack_core.c:720: >>> error: 'pskb' undeclared (first use in this function) >>> net/netfilter/nf_conntrack_core.c:720: error: (Each undeclared >>> identifier is reported only once >>> net/netfilter/nf_conntrack_core.c:720: error: for each function >>> it appears in.) >> the lines in the code are: > >> #ifdef CONFIG_HIPPIE_NETFILTER_FEED >> pie_packet_read((*pskb)->data,(*pskb)->len); #endif > >> any suggestions to fix this? > >> thanks for your help > >> best regards > >> Johann > >> - ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ HiPPIE-Users mailing list HiP...@li... https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFI+Ll8yYH7lzNnCPsRAniAAKCw2HHDeUvp9CupGBvFNiQ2bxjv6gCgqG4x AiB+6CxvNcTMgLryar5NeIQ= =N2bY -----END PGP SIGNATURE----- |
|
From: Josh B. <jo...@oo...> - 2008-10-17 14:31:58
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey Johann, Your last mail to the list got bounced about me compiling against 2.6.25.10. I guess that must be right. I'm wondering if they updated 2.6.25.10 and it broke something. Let me have a look later this afternoon still and I'll see what I can figure out. Sorry for the inconvenience. The one thing you might check is to make sure they didn't rename the skb variable to something besides pskb in that function. I'll let you know what I can find. Thanks Josh On Oct 17, 2008, at 7:27 AM, Johann Juraschek wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Josh and the List, > > it just startet to compile the hippie on 2.6.25.10. > > Actually der is one problem: > >> CC net/netfilter/nf_conntrack_core.o >> net/netfilter/nf_conntrack_core.c: In function 'nf_conntrack_in': >> net/netfilter/nf_conntrack_core.c:720: error: 'pskb' undeclared >> (first use in this function) >> net/netfilter/nf_conntrack_core.c:720: error: (Each undeclared >> identifier is reported only once >> net/netfilter/nf_conntrack_core.c:720: error: for each function it >> appears in.) > > the lines in the code are: > > #ifdef CONFIG_HIPPIE_NETFILTER_FEED > pie_packet_read((*pskb)->data,(*pskb)->len); > #endif > > any suggestions to fix this? > > thanks for your help > > best regards > > Johann > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.6 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iD8DBQFI+ISXyYH7lzNnCPsRAltDAKC3t81iz3IqgG/QPpup78wxxV5L4ACfTZIW > KqiSBAIizpv/q86gYtdxnbQ= > =Dn5V > -----END PGP SIGNATURE----- > > > ------------------------------------------------------------------------- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win > great prizes > Grand prize is a trip for two to an Open Source event anywhere in > the world > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > _______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkj4obgACgkQYj4wn+b+JWYrDACfaWb9+CayYYe7JLUzW8ud7EGw wA0AnRLgP7cf19E66bPAncxqG/I8MdLg =Fz5E -----END PGP SIGNATURE----- |
|
From: Josh B. <jo...@oo...> - 2008-10-17 13:31:51
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Johann, Thanks for your mail. I've not tried to compile against 2.6.25.10. Let me give this a try later today, and I'll let you know what I run into. Thanks! Josh On Oct 17, 2008, at 7:27 AM, Johann Juraschek wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Josh and the List, > > it just startet to compile the hippie on 2.6.25.10. > > Actually der is one problem: > >> CC net/netfilter/nf_conntrack_core.o >> net/netfilter/nf_conntrack_core.c: In function 'nf_conntrack_in': >> net/netfilter/nf_conntrack_core.c:720: error: 'pskb' undeclared >> (first use in this function) >> net/netfilter/nf_conntrack_core.c:720: error: (Each undeclared >> identifier is reported only once >> net/netfilter/nf_conntrack_core.c:720: error: for each function it >> appears in.) > > the lines in the code are: > > #ifdef CONFIG_HIPPIE_NETFILTER_FEED > pie_packet_read((*pskb)->data,(*pskb)->len); > #endif > > any suggestions to fix this? > > thanks for your help > > best regards > > Johann > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.6 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iD8DBQFI+ISXyYH7lzNnCPsRAltDAKC3t81iz3IqgG/QPpup78wxxV5L4ACfTZIW > KqiSBAIizpv/q86gYtdxnbQ= > =Dn5V > -----END PGP SIGNATURE----- > > > ------------------------------------------------------------------------- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win > great prizes > Grand prize is a trip for two to an Open Source event anywhere in > the world > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > _______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkj4j5YACgkQYj4wn+b+JWaKMACfTrDXwzapK3NkEqVi0DgKgFmc NosAn16YR0FwLTFmoLwkCsKnVakL7kZE =uqP7 -----END PGP SIGNATURE----- |
|
From: Johann J. <Joh...@2n...> - 2008-10-17 12:56:02
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Josh and the List,
it just startet to compile the hippie on 2.6.25.10.
Actually der is one problem:
> CC net/netfilter/nf_conntrack_core.o
> net/netfilter/nf_conntrack_core.c: In function 'nf_conntrack_in':
> net/netfilter/nf_conntrack_core.c:720: error: 'pskb' undeclared
> (first use in this function)
> net/netfilter/nf_conntrack_core.c:720: error: (Each undeclared
> identifier is reported only once
> net/netfilter/nf_conntrack_core.c:720: error: for each function it
> appears in.)
the lines in the code are:
#ifdef CONFIG_HIPPIE_NETFILTER_FEED
pie_packet_read((*pskb)->data,(*pskb)->len);
#endif
any suggestions to fix this?
thanks for your help
best regards
Johann
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFI+ISXyYH7lzNnCPsRAltDAKC3t81iz3IqgG/QPpup78wxxV5L4ACfTZIW
KqiSBAIizpv/q86gYtdxnbQ=
=Dn5V
-----END PGP SIGNATURE-----
|
|
From: Daniel C. <dan...@ho...> - 2008-06-07 17:58:41
|
Greetings, I just arrived to hippie page through a link from l7-filter. I want to test if there' s any kind of tool to detect applications in layer7 through a gateway, and redirecting its traffic according to the detection pattern. For l7-filter, for example, as the detection takes place after the three-way handshaking (quite logic), it doesn' t serve for the purpose, as my idea is to redirect to a honeynet detected malware or specific probe attacks. Could Hippie be used for this? Also, as I use kernel 2.6.25, I am unable to try Hippie 0.9.0, when is 0.9.1 version expected to be released? Thank you very much for the project, it sounds quite useful. Bye, Daniel Cabezas _________________________________________________________________ MSN Noticias http://noticias.msn.es/comunidad.aspx |
|
From: Andrew H. <and...@gm...> - 2008-04-15 05:41:19
|
Hi Josh,
Very excited about this project and I'm happy that you can help track this
down. Here is the memory usage:
/var/root # uname -r
2.6.23.1
/var/root # free
total used free shared buffers
Mem: 2071284 78212 1993072 0 49152
Swap: 0 0 0
Total: 2071284 78212 1993072
I've tried turning the big kernel lock on and off, and neither make any
difference. The preemptive model is set to 'desktop'. These errors (which
are always a little different each time) occur all the time as soon as
packets arrive with HIPPIE enabled. When there are a large number of inbound
packets, these error events will cause the box to stop responding until the
packet backlog has been processed. As soon as I shut off the HIPPIE
interface the errors stop. There are no user based process running.
I'll can forward the kernel config if that helps.
Regards,
Andrew.
|
|
From: Andrew H. <and...@gm...> - 2008-04-14 06:12:22
|
Just tried with 2.6.24.4 stable. Stock kernel + Hippie 0.9.0 Same issue: BUG: scheduling while atomic: dmesg/1144/0x10000100 Pid: 1144, comm: dmesg Not tainted (2.6.24.4 #1) EIP: 0060:[<c05edfc4>] EFLAGS: 00000292 CPU: 0 EIP is at _spin_unlock_irqrestore+0x5/0x6 EAX: f31bed38 EBX: f31bec00 ECX: f31bc000 EDX: 00000292 ESI: f31be438 EDI: f31c32bd EBP: f31be400 ESP: f31bde20 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 CR0: 8005003b CR2: 08093000 CR3: 331b0000 CR4: 000006f0 DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 DR6: ffff0ff0 DR7: 00000400 [<c0292e62>] n_tty_receive_buf+0x2d3/0xeb6 [<c05043fd>] net_rx_action+0x85/0x186 [<c05043fd>] net_rx_action+0x85/0x186 [<c0121482>] __do_softirq+0x72/0xdf [<c0294e69>] pty_write+0x39/0x41 [<c0294e69>] pty_write+0x39/0x41 [<c0292a0e>] write_chan+0x18d/0x30e [<c0117d11>] default_wake_function+0x0/0x8 [<c02903c7>] tty_write+0x123/0x1b3 [<c0292881>] write_chan+0x0/0x30e [<c015e036>] vfs_write+0x8b/0x118 [<c02902a4>] tty_write+0x0/0x1b3 [<c015e5ec>] sys_write+0x41/0x6a [<c01027fe>] sysenter_past_esp+0x5f/0x85 [<c05e0000>] dccp_reqsk_init+0x13/0x1b ======================= |
|
From: Andrew H. <and...@gm...> - 2008-04-14 02:02:06
|
Hi Josh,
Very excited about this project and I'm happy that you can help track this
down. Here is the memory usage:
/var/root # uname -r
2.6.23.1
/var/root # free
total used free shared buffers
Mem: 2071284 78212 1993072 0 49152
Swap: 0 0 0
Total: 2071284 78212 1993072
I've tried turning the big kernel lock on and off, and neither make any
difference. The preemptive model is set to 'desktop'. These errors (which
are always a little different each time) occur all the time as soon as
packets arrive with HIPPIE enabled. When there are a large number of inbound
packets, these error events will cause the box to stop responding until the
packet backlog has been processed. As soon as I shut off the HIPPIE
interface the errors stop. There are no user based process running.
I'll attach the kernel config and try a later version of the kernel.
|
|
From: Josh B. <jo...@oo...> - 2008-04-11 23:50:16
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Andrew, Thanks for your mail. I've not seen those errors before. I will definitely dig and see what I can come up with. How much memory is in this system, and how much of it is used when this starts to occur? Does it happen all the time? Do you have kernel lock override turned on, or what is the kernel set for in preemption? If you could give me some more details, I would be glad to see if I could help out. Thanks Josh Ballard HiPPIE Developer On Apr 10, 2008, at 10:25 PM, Andrew Hall wrote: > When Hippie 0.9.0 is applied to stock 2.6.23.1, I get the following > errors which seem to correspond to an packet arrival event: > > BUG: scheduling while atomic: ps/0x10000100/1162 > [<c05a98a2>] __sched_text_start+0x5a2/0x6a4 > [<c04eab96>] tcp_packet+0x4ae/0xbc8 > [<c01243cf>] lock_timer_base+0x19/0x35 > [<c01244e0>] __mod_timer+0x92/0xa1 > [<c0118ee0>] __cond_resched+0x16/0x34 > [<c05a9a0f>] cond_resched+0x2a/0x31 > [<c0154cf7>] kmem_cache_alloc+0x49/0x7e > [<c04fa237>] pie_packet_mockup+0x19/0x102 > [<c04fa3da>] pie_packet_read+0xc/0x2e8 > [<c04fa6c7>] pie_packet_read_skb+0x11/0x1b > [<c04c014f>] netif_receive_skb+0x316/0x39e > [<c04bbb52>] __alloc_skb+0x47/0xf6 > [<c02cc6f4>] e1000_clean_rx_irq+0x15e/0x4d7 > [<c02cc596>] e1000_clean_rx_irq+0x0/0x4d7 > [<c02cb553>] e1000_clean+0x2a6/0x5fd > [<c011635c>] update_curr+0x121/0x12d > [<c04c2204>] net_rx_action+0x66/0xfe > [<c0120b62>] __do_softirq+0x72/0xdf > [<c0120c06>] do_softirq+0x37/0x39 > [<c0120e04>] irq_exit+0x6c/0x6e > [<c0104e77>] do_IRQ+0x40/0x79 > [<c01031ef>] common_interrupt+0x23/0x28 > [<c05ab054>] _spin_unlock_irqrestore+0x5/0x6 > [<c028a162>] n_tty_receive_buf+0x2d3/0xeb6 > [<c015ffef>] link_path_walk+0x65/0xbc > [<c0245979>] _atomic_dec_and_lock+0x2d/0x54 > [<c0156585>] get_unused_fd_flags+0x52/0xc7 > [<c016023e>] do_path_lookup+0x73/0x1a1 > [<c0158ba8>] file_move+0x14/0x34 > [<c028c129>] pty_write+0x39/0x41 > [<c0289d05>] write_chan+0x18d/0x317 > [<c0117b1d>] default_wake_function+0x0/0xc > [<c02876d8>] tty_write+0x123/0x1b3 > [<c0289b78>] write_chan+0x0/0x317 > [<c01672fc>] dput+0x10/0xf3 > [<c0158246>] vfs_write+0x8b/0x118 > [<c016aad4>] mntput_no_expire+0x13/0x5a > [<c02875b5>] tty_write+0x0/0x1b3 > [<c01587fb>] sys_write+0x41/0x6a > [<c01027de>] sysenter_past_esp+0x5f/0x85 > [<c05a0000>] dccp_init_sock+0x172/0x179 > > If I shut down HIPPIE from the interface, the errors go away. I have > hippie DEBUG enabled, but these don’t look like debug errors. > > Thanks, > ------------------------------------------------------------------------- > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference > Don't miss this year's exciting event. There's still time to save > $100. > Use priority code J8TL2D2. > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone_______________________________________________ > HiPPIE-Users mailing list > HiP...@li... > https://lists.sourceforge.net/lists/listinfo/hippie-users -----BEGIN PGP SIGNATURE----- iD8DBQFH//kPtQyUkgUe3nkRAj82AJ9peUbq2aY8RaK6xLDaYxOvr8ud8gCfTNsg yujJCfhj6exQbt3ng9vSOX8= =WrLG -----END PGP SIGNATURE----- |
|
From: Andrew H. <and...@gm...> - 2008-04-11 03:26:25
|
When Hippie 0.9.0 is applied to stock 2.6.23.1, I get the following errors which seem to correspond to an packet arrival event: BUG: scheduling while atomic: ps/0x10000100/1162 [<c05a98a2>] __sched_text_start+0x5a2/0x6a4 [<c04eab96>] tcp_packet+0x4ae/0xbc8 [<c01243cf>] lock_timer_base+0x19/0x35 [<c01244e0>] __mod_timer+0x92/0xa1 [<c0118ee0>] __cond_resched+0x16/0x34 [<c05a9a0f>] cond_resched+0x2a/0x31 [<c0154cf7>] kmem_cache_alloc+0x49/0x7e [<c04fa237>] pie_packet_mockup+0x19/0x102 [<c04fa3da>] pie_packet_read+0xc/0x2e8 [<c04fa6c7>] pie_packet_read_skb+0x11/0x1b [<c04c014f>] netif_receive_skb+0x316/0x39e [<c04bbb52>] __alloc_skb+0x47/0xf6 [<c02cc6f4>] e1000_clean_rx_irq+0x15e/0x4d7 [<c02cc596>] e1000_clean_rx_irq+0x0/0x4d7 [<c02cb553>] e1000_clean+0x2a6/0x5fd [<c011635c>] update_curr+0x121/0x12d [<c04c2204>] net_rx_action+0x66/0xfe [<c0120b62>] __do_softirq+0x72/0xdf [<c0120c06>] do_softirq+0x37/0x39 [<c0120e04>] irq_exit+0x6c/0x6e [<c0104e77>] do_IRQ+0x40/0x79 [<c01031ef>] common_interrupt+0x23/0x28 [<c05ab054>] _spin_unlock_irqrestore+0x5/0x6 [<c028a162>] n_tty_receive_buf+0x2d3/0xeb6 [<c015ffef>] link_path_walk+0x65/0xbc [<c0245979>] _atomic_dec_and_lock+0x2d/0x54 [<c0156585>] get_unused_fd_flags+0x52/0xc7 [<c016023e>] do_path_lookup+0x73/0x1a1 [<c0158ba8>] file_move+0x14/0x34 [<c028c129>] pty_write+0x39/0x41 [<c0289d05>] write_chan+0x18d/0x317 [<c0117b1d>] default_wake_function+0x0/0xc [<c02876d8>] tty_write+0x123/0x1b3 [<c0289b78>] write_chan+0x0/0x317 [<c01672fc>] dput+0x10/0xf3 [<c0158246>] vfs_write+0x8b/0x118 [<c016aad4>] mntput_no_expire+0x13/0x5a [<c02875b5>] tty_write+0x0/0x1b3 [<c01587fb>] sys_write+0x41/0x6a [<c01027de>] sysenter_past_esp+0x5f/0x85 [<c05a0000>] dccp_init_sock+0x172/0x179 If I shut down HIPPIE from the interface, the errors go away. I have hippie DEBUG enabled, but these don't look like debug errors. Thanks, |