click http classification

Hello, 

Sorry for repeated questions. I know I can search and dig for few answers when i look into the code for a longer time, but I thought a question before that might help and save me a lot of time by guiding in the right direction. 

1. Does Click have HTTP classification. For instance is it possible to classify http like we do in the case of tcp icmp or udp using classifiers? or the only way to do this is to create a new http header like ip.h or tcp.h and try to parse the data payload like in linux stack? 

Thanks a lot in advance. 
________________________________________
From: [email protected] [[email protected]] on behalf of [email protected] [[email protected]]
Sent: Monday, June 25, 2012 12:00 PM
To: [email protected]
Subject: click Digest, Vol 108, Issue 10

Send click mailing list submissions to
        [email protected]

To subscribe or unsubscribe via the World Wide Web, visit
        https://amsterdam.lcs.mit.edu/mailman/listinfo/click
or, via email, send a message with subject or body 'help' to
        [email protected]

You can reach the person managing the list at
        [email protected]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of click digest..."


Today's Topics:

   1. Re: tcpdump file link type header format - in detail
      (Vaithiyanathan Sundaram)
   2. Re: About my ipsec additions (Markku Savela)
   3. Re: tcpdump file link type header format - in detail
      (Beyers Cronje)


----------------------------------------------------------------------

Message: 1
Date: Sun, 24 Jun 2012 20:11:16 +0000
From: Vaithiyanathan Sundaram <[email protected]>
Subject: Re: [Click] tcpdump file link type header format - in detail
To: "[email protected]" <[email protected]>
Message-ID:
        <2F4314DB472A5B4387DBE195EF7F79F4500B26@BY2PRD0710MB365.namprd07.prod.outlook.com>

Content-Type: text/plain; charset="us-ascii"

Thank you so much for your response Beyers.

This is what I did:

1. TCPDUMP capture commands I tried so far: (I am running linux in Virtual Box). I tried the same in standalone linux too.
tcpdump -i p2p1 -w final.dump
tcpdump -i p2p1 -f tcp -w final.dump
tcpdump -i p2p1 ip -w final.dump
tcpdump -i p2p1 tcp -w final.dump
tcpdump -i p2p1 -A -w final.dump
tcpdump -i p2p1 -x -A -w final.dump
tcpdump -i p2p1 -x -A -nn -vvv -w final.dump
All the commands produced different dumps indeed.

2. My different versions of the .click config files
FromDump(/home/Vaidsu/ClickGUD/click-2.0.1/click-tutorial1/gud.dump, STOP true)
-> cip  :: MarkIPHeader
-> ctcp :: CheckTCPHeader(DETAILS true)
-> Discard
DriverManager(pause, print >>details.drops ctcp.drops,
                print >>details.drops ctcp.drop_details)
I used MarkIPHeader, CheckIPHeader and even Align(2/4/8,0) offset.
I also tried to use FromDump -> ToDump to convert from EN10MB trace to RAW IP trace.

3. In addition to all these I tried to generate the same dump files in tshark, even WinDump and tried using it here. Also tried converting pcap wireshark dump and using it.

4. I tried FromTcpdump too.

The errors I got so far:
1. Bad Ip header
2. warning: first line suspicious; is this a tcpdump output file?
3. packet parse error - while using FromTcpdump
4. Importantly when I get no error, I found that the details.drops reported that all packets are not TCP. I bet there are lots of TCP flows in the trace. Wireshark could detect it.
9420
9420    not TCP
0       bad packet length
0       bad TCP checksum

Sorry for the long mail. wanted to completely explain my attempts to get your help. I am stuck here.
1. Do I need to create a file that capture RAW IP by avoiding link level headers? Or
2. Do I need to create my own parser to parse the dump files?

Thanks in advance.


________________________________________
From: [email protected] [[email protected]] on behalf of [email protected] [[email protected]]
Sent: Sunday, June 24, 2012 12:00 PM
To: [email protected]
Subject: click Digest, Vol 108, Issue 9

Send click mailing list submissions to
        [email protected]

To subscribe or unsubscribe via the World Wide Web, visit
        https://amsterdam.lcs.mit.edu/mailman/listinfo/click
or, via email, send a message with subject or body 'help' to
        [email protected]

You can reach the person managing the list at
        [email protected]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of click digest..."


Today's Topics:

   1. tcpdump file link type header format (Vaithiyanathan Sundaram)
   2. Re: tcpdump file link type header format (Beyers Cronje)


----------------------------------------------------------------------

Message: 1
Date: Sat, 23 Jun 2012 19:44:53 +0000
From: Vaithiyanathan Sundaram <[email protected]>
Subject: [Click] tcpdump file link type header format
To: "[email protected]" <[email protected]>
Message-ID:
        <2F4314DB472A5B4387DBE195EF7F79F4500AFD@BY2PRD0710MB365.namprd07.prod.outlook.com>

Content-Type: text/plain; charset="iso-8859-1"

Hello,

My first requirement is to generate TCP traffic with respect to the input in the form of tcpdump.
I tried using
FromDump(...)
-> CheckTCPHeader
-> My parser
-> TCPIPSend (according to the parser).

I am working on a shared buffer research. I need a tcp traffic generator as per the dump. My only problem is the tcpdump type. I could only collect a TCP dump with EN01B (ethernet) link type header. I think click elements requires RAW IP header format. How do I generate that? Is there any other way.

Please help. Thanks a lot.

Vaithiyanathan
Mailing list: [email protected]


------------------------------

Message: 2
Date: Sat, 23 Jun 2012 22:46:28 +0200
From: Beyers Cronje <[email protected]>
Subject: Re: [Click] tcpdump file link type header format
To: "[email protected]" <[email protected]>
Message-ID:
        <CAOO3n8WgdAE36QSv9R=74Fhx69sWcZT-_MPfZFiSTFo=OGRjig@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

Have you actually tried running FromDump with that capture file? What error
are you getting?

Note you should include a MarkIPHeader or CheckIPHeader element before
CheckTCPHeader as it requires the IP header annotation to be set already.

Beyers

On Sat, Jun 23, 2012 at 9:44 PM, Vaithiyanathan Sundaram <
[email protected]> wrote:

> Hello,
>
> My first requirement is to generate TCP traffic with respect to the input
> in the form of tcpdump.
> I tried using
> FromDump(...)
> -> CheckTCPHeader
> -> My parser
> -> TCPIPSend (according to the parser).
>
> I am working on a shared buffer research. I need a tcp traffic generator
> as per the dump. My only problem is the tcpdump type. I could only collect
> a TCP dump with EN01B (ethernet) link type header. I think click elements
> requires RAW IP header format. How do I generate that? Is there any other
> way.
>
> Please help. Thanks a lot.
>
> Vaithiyanathan
> Mailing list: [email protected]
> _______________________________________________
> click mailing list
> [email protected]
> https://amsterdam.lcs.mit.edu/mailman/listinfo/click
>


------------------------------

_______________________________________________
click mailing list
[email protected]
https://amsterdam.lcs.mit.edu/mailman/listinfo/click


End of click Digest, Vol 108, Issue 9
*************************************





------------------------------

Message: 2
Date: Mon, 25 Jun 2012 09:37:54 +0300
From: Markku Savela <[email protected]>
Subject: Re: [Click] About my ipsec additions
To: <[email protected]>
Cc: [email protected]
Message-ID: <[email protected]>
Content-Type: text/plain; charset="UTF-8"; format=flowed

On 06/22/2012 07:00 PM, Eddie Kohler wrote:

> But I looked through it very briefly for nits. Here are two,
> interested in your thoughts.
> - IPsec::Mutex: Why? We have Spinlock for this... At least make it a
> nested class or call it IPsecMutex.

I guess I forgot to look for such. Though, the main service
of my version is the automatic lock on construct and automatic
release on destructor -- you get "critical" region for the code
block by simply declaring the mutex inside it -- no other calls
needed because the compiler does all the work (no worry about
accidentally leaving the lock on). But yes, could be derived
from Spinlock...

> - dynamic_cast: What you actually want to do here is call "cast()", a
> Click-specific function designed for exactly this use. So
>
> IPsecTransform *tr = (IPsecTransform *)
> e->output(port).element()->cast("IPsecTransform");

Assuming it returns NULL, if element is not derived from
IPsecTransform.


------------------------------

Message: 3
Date: Mon, 25 Jun 2012 10:49:22 +0200
From: Beyers Cronje <[email protected]>
Subject: Re: [Click] tcpdump file link type header format - in detail
To: "[email protected]" <[email protected]>
Message-ID:
        <CAOO3n8Xh-eF2Y7Jy=MXD4BNF5OnxrL--Hq=NtAKnEsOQB9j10A@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

Hi,

You need to give the offset of where the IP header starts. You also can't
just assume that all packets are indeed IP or TCP. So I would suggest
something in the line of the following example (note this example is for
ethernet, change to your layer 2 protocol specs accordingly):

FromDump(dump.pcap) -> Classifier(12/0800) -> MarkIPHeader(14) ->
IPClassifier(tcp) ->  CheckTCPHeader -> your other elements

Beyers

On Sun, Jun 24, 2012 at 10:11 PM, Vaithiyanathan Sundaram <
[email protected]> wrote:

> Thank you so much for your response Beyers.
>
> This is what I did:
>
> 1. TCPDUMP capture commands I tried so far: (I am running linux in Virtual
> Box). I tried the same in standalone linux too.
> tcpdump -i p2p1 -w final.dump
> tcpdump -i p2p1 -f tcp -w final.dump
> tcpdump -i p2p1 ip -w final.dump
> tcpdump -i p2p1 tcp -w final.dump
> tcpdump -i p2p1 -A -w final.dump
> tcpdump -i p2p1 -x -A -w final.dump
> tcpdump -i p2p1 -x -A -nn -vvv -w final.dump
> All the commands produced different dumps indeed.
>
> 2. My different versions of the .click config files
> FromDump(/home/Vaidsu/ClickGUD/click-2.0.1/click-tutorial1/gud.dump, STOP
> true)
> -> cip  :: MarkIPHeader
> -> ctcp :: CheckTCPHeader(DETAILS true)
> -> Discard
> DriverManager(pause, print >>details.drops ctcp.drops,
>                print >>details.drops ctcp.drop_details)
> I used MarkIPHeader, CheckIPHeader and even Align(2/4/8,0) offset.
> I also tried to use FromDump -> ToDump to convert from EN10MB trace to RAW
> IP trace.
>
> 3. In addition to all these I tried to generate the same dump files in
> tshark, even WinDump and tried using it here. Also tried converting pcap
> wireshark dump and using it.
>
> 4. I tried FromTcpdump too.
>
> The errors I got so far:
> 1. Bad Ip header
> 2. warning: first line suspicious; is this a tcpdump output file?
> 3. packet parse error - while using FromTcpdump
> 4. Importantly when I get no error, I found that the details.drops
> reported that all packets are not TCP. I bet there are lots of TCP flows in
> the trace. Wireshark could detect it.
> 9420
> 9420    not TCP
> 0       bad packet length
> 0       bad TCP checksum
>
> Sorry for the long mail. wanted to completely explain my attempts to get
> your help. I am stuck here.
> 1. Do I need to create a file that capture RAW IP by avoiding link level
> headers? Or
> 2. Do I need to create my own parser to parse the dump files?
>
> Thanks in advance.
>
>
> ________________________________________
> From: [email protected] [[email protected]]
> on behalf of [email protected] [
> [email protected]]
> Sent: Sunday, June 24, 2012 12:00 PM
> To: [email protected]
> Subject: click Digest, Vol 108, Issue 9
>
> Send click mailing list submissions to
>        [email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>        https://amsterdam.lcs.mit.edu/mailman/listinfo/click
> or, via email, send a message with subject or body 'help' to
>        [email protected]
>
> You can reach the person managing the list at
>        [email protected]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of click digest..."
>
>
> Today's Topics:
>
>   1. tcpdump file link type header format (Vaithiyanathan Sundaram)
>   2. Re: tcpdump file link type header format (Beyers Cronje)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sat, 23 Jun 2012 19:44:53 +0000
> From: Vaithiyanathan Sundaram <[email protected]>
> Subject: [Click] tcpdump file link type header format
> To: "[email protected]" <[email protected]>
> Message-ID:
>        <
> 2F4314DB472A5B4387DBE195EF7F79F4500AFD@BY2PRD0710MB365.namprd07.prod.outlook.com
> >
>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Hello,
>
> My first requirement is to generate TCP traffic with respect to the input
> in the form of tcpdump.
> I tried using
> FromDump(...)
> -> CheckTCPHeader
> -> My parser
> -> TCPIPSend (according to the parser).
>
> I am working on a shared buffer research. I need a tcp traffic generator
> as per the dump. My only problem is the tcpdump type. I could only collect
> a TCP dump with EN01B (ethernet) link type header. I think click elements
> requires RAW IP header format. How do I generate that? Is there any other
> way.
>
> Please help. Thanks a lot.
>
> Vaithiyanathan
> Mailing list: [email protected]
>
>
> ------------------------------
>
> Message: 2
> Date: Sat, 23 Jun 2012 22:46:28 +0200
> From: Beyers Cronje <[email protected]>
> Subject: Re: [Click] tcpdump file link type header format
> To: "[email protected]" <[email protected]>
> Message-ID:
>        <CAOO3n8WgdAE36QSv9R=74Fhx69sWcZT-_MPfZFiSTFo=OGRjig@mail.gmail.com
> >
> Content-Type: text/plain; charset=ISO-8859-1
>
> Have you actually tried running FromDump with that capture file? What error
> are you getting?
>
> Note you should include a MarkIPHeader or CheckIPHeader element before
> CheckTCPHeader as it requires the IP header annotation to be set already.
>
> Beyers
>
> On Sat, Jun 23, 2012 at 9:44 PM, Vaithiyanathan Sundaram <
> [email protected]> wrote:
>
> > Hello,
> >
> > My first requirement is to generate TCP traffic with respect to the input
> > in the form of tcpdump.
> > I tried using
> > FromDump(...)
> > -> CheckTCPHeader
> > -> My parser
> > -> TCPIPSend (according to the parser).
> >
> > I am working on a shared buffer research. I need a tcp traffic generator
> > as per the dump. My only problem is the tcpdump type. I could only
> collect
> > a TCP dump with EN01B (ethernet) link type header. I think click elements
> > requires RAW IP header format. How do I generate that? Is there any other
> > way.
> >
> > Please help. Thanks a lot.
> >
> > Vaithiyanathan
> > Mailing list: [email protected]
> > _______________________________________________
> > click mailing list
> > [email protected]
> > https://amsterdam.lcs.mit.edu/mailman/listinfo/click
> >
>
>
> ------------------------------
>
> _______________________________________________
> click mailing list
> [email protected]
> https://amsterdam.lcs.mit.edu/mailman/listinfo/click
>
>
> End of click Digest, Vol 108, Issue 9
> *************************************
>
>
>
> _______________________________________________
> click mailing list
> [email protected]
> https://amsterdam.lcs.mit.edu/mailman/listinfo/click
>


------------------------------

_______________________________________________
click mailing list
[email protected]
https://amsterdam.lcs.mit.edu/mailman/listinfo/click


End of click Digest, Vol 108, Issue 10
**************************************