0

I need to edit 1 line in /proc/net/tcp while the file is also used by the linux kernel for updating other lines of it by the kernel.

Background: Each line in /proc/net/tcp represents a TCP socket. The kernel uses this file to show the state and statistics of each socket in the system. I want to fake the statisics of 1 socket in the system, because I'm capturing its traffic and passing it directly to the network card, without the kernel's knowledge.

Improve this question
2
  • This question doesn't make sense: /proc/net/tcp reflects what is happening in the system, it isn't read by the kernel. Furthermore you can't do something without the kernel's knowledge. What are you trying to accomplish? Who's going to read the statistics that you want to fake? Commented Apr 21, 2015 at 22:04
  • The statistics in this file are read by utilities such as netstat and ss that are available to users, and this is what I want to achieve. And... of course I can do things without the kernel knowledge, it is called bypassing the kernel. If you do RDMA than the network card pass data to/from user space program without the kernel knowledge. Commented Apr 22, 2015 at 8:15

1 Answer 1

Reset to default
4

/proc/net/tcp is not a real file, that can be edited. Each time you read from it, kernel allocates temporary buffer called a seq file, and writes statistics there from current in-kernel data.

You may only hjack that by changing code in tcp4_seq_show() in net/ipv4/tcp_ipv4.c and subsequent functions.

Note that /proc/net/tcp is actually is a symlink to a /proc/self/net/tcp, so if you put your process into a namespace, it won't see your connections at all.

Improve this answer
9
  • Thanks myaut. Can I achieve that by creating a kernel module instead of changing the kernel code? Commented Apr 22, 2015 at 8:23
  • @avner: I think you can do that. I think that the easiest way to do that is to silently remove /proc/self/net/tcp, copy-paste related code from net/ipv4/tcp_ipv4.c and change it the way you want to. Commented Apr 22, 2015 at 8:26
  • thanks again. Will this allow standard utilities such as netstat and ss to present data of my fake socket among the standard TCP sockets? I mean where will they find the data if I silently remove /proc/self/net/tcp? Commented Apr 22, 2015 at 9:15
  • Not only remove, but create a new entry with fake data. Commented Apr 22, 2015 at 9:18
  • I think I am starting to understand; however, I still misses something :-(. I see several opions: 1. Chnage just struct seq_file of my fake socket - this would be ideal; however, I don't understand how to do that from a kernel module that is outside the kernel itself. 2. Change the current in kernel data regarding my fake socket - this is equivalent to my orig question: how to change a line in /proc/net/tcp? 3. silently remove /proc/self/net/tcp and provide new data in same place - how to do that and when to do that? Commented Apr 22, 2015 at 9:58

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.