Skip to content

Collector: Live Capture with AF_PACKET

Raw DNS packets sniffer. Setting CAP_NET_RAW capabilities on executables allows you to run these program without having to run-it with the root user:

  • IPv4, IPv6 support (fragmented packet ignored)
  • UDP and TCP transport (with tcp reassembly if needed)
  • BFP filtering
  • GRE tunnel support

Capabilities:

sudo setcap cap_net_admin,cap_net_raw=eip dnscollector

Options:

  • port (int)

    filter on source and destination port.

  • device (str)

    Interface name to sniff. If value is empty, bind on all interfaces.

  • enable-rawip (bool)

    Enable the decoding of raw IP traffic (without ethernet layer), enable this option to sniff gre interface

  • enable-gre (bool)

    Enable GRE decoding protocol support

  • enable-defrag-ip (bool)

    Enable IP defrag support

  • chan-buffer-size (int)

    Specifies the maximum number of packets that can be buffered before discard additional packets. Set to zero to use the default global value.

Defaults values:

- name: sniffer
  afpacket-sniffer:
    port: 53
    device: wlp2s0
    enable-rawip: false
    enable-gre: false
    enable-defrag-ip: true
    chan-buffer-size: 0

This configuration is designed to enable traffic capture on a GRE interface (e.g., gre1) in Raw IP mode, meaning Ethernet headers will not be present.

- name: sniffer_gre
  afpacket-sniffer:
    port: 53
    device: gre1
    enable-rawip: true

This configuration is used to capture and decode GRE traffic passing through a physical interface:

- name: sniffer_gre
  afpacket-sniffer:
    port: 53
    device: wlp2s0
    enable-gre: true