Re: Packet rate limiting

On Fri, Jul 11, 2003 at 04:43:01PM -0700, Dan Kaminsky wrote:

[snip]

> BTW, Aaron -- does Libnet 1.0's send fuctions return before the packet
> actually hits the wire?

Well on Linux and BSD at least (and prolly any POSIX system in the world), you're really writing to a buffer rather then directly to the device driver. Hence the OS is buffering packets to be sent, and considering the buffer size is adjustable by the administator (see the tcpreplay FAQ for info on how to do this on Linux and BSD) would make libnet_adv_write_link() both non-atomic and non-blocking when the buffer has sufficent space for the packet. See the send(2) manpage for details. This means that libnet_adv_write_link() can and may return before the packet has been passed to the NIC driver, let alone be placed on the wire.

I have actually seen cases when tcpreplay has quit and packets are still being sent because the buffer was significantly large and full.

If you really need that level of timing, your best best is a RTOS IMHO.

-- 
Aaron Turner   
http://synfin.net/aturner
They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety. -- Benjamin Franklin
All emails are PGP signed; a lack of a signature indicates a forgery.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek