October 2008

Is the memory leak still present in v1.1 of pcap_callback?

Hi Mark,

hope you had a nice time on your holiday!

Just wondering if the memory leak fixed in the v1.2 code was back ported to v1.1

I took a look at the v1.1 pcap_callback and it still seems to be missing the following line:

env->DeleteLocalRef(buffer);

I think this is the fix. Can I just add it to the v1.1 code if it is?

Ta,
Scott

v1.1 issue in WinPcapSendQueue

Noted the following in v1.1, and since I didn't find an issues db on-site, figured this was the place to post it...

WinPcapSendQueue(int size) constructor is ignoring the size argument, and always setting the buffer size to DEFAULT_QUEUE_SIZE.

SteveS

1.1 source code snapshot

Is there any easy way to get a snapshot of the 1.1 source code tree? I'd
like to look at what is involved in making a Mac OS X version (both Tiger
and Leopard).

Thanks..

Tom.

Mark's vacation

I will be on vacation all of the next week. Its a 7 night cruise. I won't be able to respond to inquiries as fast as when I'm in the office. But I will do my best. I should be able to do the release 1.2 within next week or 2 after my return on the 2nd of November.

Off to get a sun tan I go.

Packet org.jnetpcap.packet - Overview

Class Hierarchies

The class hierarchies are as follows:

JMemory
 +-> JStruct
 |   +-> JPacket.State // peered with "struct packet_state_t"
 |   +-> JHeader.State // peered with "struct header_t"
 |   +-> JScanner      // peered with "struct scanner_t"
 |   +-> PcapHeader    // peered with "struct pcap_pkthdr"
 |   +->[AircapHeader] // Possibility in the future
 |
 +-> JBuffer           // peered with "unsigned char *"
     +-> JHeader
     |   +-> Ethernet  
     |   +-> Ip4
     |   +-> Ip6
     |   +-> Tcp
     |   ...
     |
     +-> JPacket
         +-> PcapPacket
         +->[AircapPacket] // Possibility in the future

Scanner is working

The JScanner, JPacket, JHeader, JRegistry and all kind of things came together to make this working jUnit test case not fail and produce output. The test case creates a dummy packet directly in memory, initializes only the Ethernet header with dummy dst and src addresses, but a valid 0x800 type field which specifies that Ip4 is the next header. Ip4 is not initialized therefore all its fields including the hlen field multiplied by 4 will come up with 0 length header. The last header in any packet is always going to be Payload.

Packet decoding

I've been working on various aspects of jNetPcap. Besides the unix and MS extensions, I've also been working on packet decoding. The decoding isn't as involved and thorough as you will find in jNetStream but should do the job for most needs. If this feature ends up in 1.2 release it will be released as a beta feature stored in a separate JAR file, so not to interfere or be confused with the rest of jNetPcap that is very stable and production quality. The single DLL contains all the necessary JNI code since none of it overlaps with the production side of the API.

New Platforms

Just a heads up that I'm working on adding new platforms to supported platforms:

  • Ubuntu
  • FreeBSD
  • OpenDarwin x86
  • Solaris x86

All these are on x86.

This is in addition to existing platforms: win32, fedora core and debian.

jNetPcap 1.2 Release Overview

jNetPcap 1.2 introduces several new features and small changes to to the existing jNetPcap API.

New Features

  • Packet decoding - new extension added org.jnetpcap.packet - provides native packet scanner and protocols
  • Protocol Analysis - stateful packet inspection and analysis. Streams of packets are analyzed, sequenced and reassembled if necessary.
  • PcapUtils class - static utility methods
  • New NIO classes - JMemory, JNumber, JStruct, JFunct, JBuffer - provide efficient struct pointer like functionality.
  • Retrieval of hardware interface address - using MS and Unix extensions and a PcapUtils.getHardwareAddress(String):byte[] is provided.
  • New libpcap handlers - ByteBufferHandler class, JBufferHandler class, JPacketHandler class

Deprecates

  • PcapInteger class - will be replaced by JNumber class
  • PcapHandler class - replaced by ByteBufferHandler class
  • PcapPktHdr class - replaced by PcapHeader class

Bugs

  • Memory leak in PcapHandler - a memory leak has been fixed in the JNI method which prevented the allocated ByteBuffer objects from being garbage collected.
  • sendqueue(int size) size parameter was ignored. Fixed.

Updates: rc2 to rc3 changes

  • Added PcapPacket(JPacket) constructor.

Details

Release 1.2 adds significant new features and capabilities to jNetPcap library.

Memory management with org.jnetpcap.nio package

Microsoft extensions to jNetPcap

jNetPcap 1.2 will have Microsoft IpHelper API extensions. This extension allows retrieval of MAC address and also provides a number of other useful statistics and information about network interface not available from libpcap itself. The documentation is in javadoc that describes its usage.

PcapUtils contains a getHardwareAddress(String):byte[] method which abstracts the underlying details on how to retrieve a mac address on each platform using the extensions.