Visualize the IP address of the traffic through the Raspberry PI

发表于   |   分类于

The IO performance of RPi 3B

The hardware of a RPi 3B is listed below, no surprise, just ordinary as his ancestor：
from rpi’s official site

  • 802.11n Wireless LAN
  • 4 USB ports (usb 2.0)
  • 40 GPIO pins
  • Full HDMI port
  • Ethernet port(100Mbps)
  • Camera interface (CSI)
  • Display interface (DSI)
  • Micro SD card slot (now push-pull rather than push-push)

In this generation of RPi, this limitation of performance is mainly in its IO performance, The 100Mbps Ethernet, usb 2.0 and 802.11n Wifi. This kind of performance has kill is possibility to become a NAS, which I think should have at least 2 STAT, use3.0, 1Gbps Ethernet, and a powerful Soc to satisfy this kind of IO requirement. But to be a wireless router, RPi its enough.

Sniff the packet

At the beginning, I use scapy to capture the traffic through the RPi like:

1
sniff(iface='ppp0', prn=lambda x: self.handle(x))

however, its cpu usage is ultra hight to >100%, result in a high ratio of package loss. (~10% captured).
After that I find use layer 2’s socket and tcpdump may be better solution.

1
sudo tcpdump -i ppp0 -w out traffic.pcap

which i can save the traffic to a pcap file and handle it in scapy.

Handle the packet and get the address:

In this capture, we will get the ip address of the traffic, check if it is the local ip or board cast ip address. than, query the public api to get the ipaddress.

1
2
3
4
5
6
pkts = rdpkt("traffic.pcap")
results = []
for x in pkts:
	if IP in x:
		if not x[IP].dst[:7] == '192.168' and not x[IP][:10] == '255.255.255'
			results.append(x[IP].dst)