Support for packets from pcap or af_packet

[stephanbuys]

Hi all, where in the stack (tokio-core, mio, etc) would one add support for Packets/Frames over and above TPC/UDP support? I think there is a wonderful use-cases for non-blocking DPI (https://en.wikipedia.org/wiki/Deep_packet_inspection) and a ton of use-cases that arise using the tokio framework.

[carllerche]

Probably Mio? I'm not entirely sure how pcap/ af_packet works. Is there a tl;dr of how one would use it from with epoll, kqueue, or on windows?

[stephanbuys]

Here as relatively decent articles, as far as I can see af_packet actually give a handle which should be compatible with epoll according to others (http://lxr.linux.no/linux+v2.6.36/Documentation/networking/packet_mmap.txt), here is a relatively decent article: http://yusufonlinux.blogspot.co.za/2010/11/data-link-access-and-zero-copy.html

libpcap is a C library, so will need ffi bindings but gives a good cross-platform API to all platforms. I couldn't spot af_packet support in the pcap crate for Rust (but I didn't spend a lot of time looking at it).

As for Windows, it doesn't actually have raw socket support and you normally need to install WinPCAP which supplies a driver to enable that feature (making the libpcap route a bit more sensible)

Edit: Rusty reference: https://github.com/libpnet/libpnet/blob/master/src/datalink/linux.rs

[alexcrichton]

@stephanbuys my guess is that it would look like this: https://tokio.rs/docs/going-deeper/core-low-level/#custom-io

Like @carllerche though I'm unfamiliar with this area so that may not be quite right.

[conradev]

@stephanbuys, my repo tun2tor turns a TUN fd into a Sink/Stream for packets and might be a helpful example! It makes a PollEvented, like @alexcrichton suggested in his link above.

[seirdb]

Is there still interest in adding this to tokio-core/mio? I'm currently working on a tool where I need access to raw Layer 2 packets.

I'm willing to take a slight detour from and work towards a PR for this issue/feature.

[carllerche]

@seirdb I'd recommend opening a new discussion here.

Since it looks like it integrates with epoll & co, this will probably work well as a crate that integrates w/ the tokio reactor.

[buckle2000]

@seirdb Maybe you mean libpnet?