2

I know there are tools to inspect packets (e.g. wireshark) or to simulate latency/packet loss (e.g. netem), but they all seem to require administrative permissions to inspect/modify packets.

I'm looking for something which could intercept packets for a single application and be usable by a standard (non-root) user.

I'd like some kind of valgrind tool for network, where you use it to wrap your application and it intercepts network requests to inspect/modify them.

My main use case is to enable students to use such tools on university computers in a simple way (i.e. without needing virtual machines or support from the administrators).

Do such tools exist? Otherwise, what prevents them from actually existing in the first place?

Note: tools such as setcap, which need to be configured by system administrators and may grant too many powers to the users (e.g. inspecting every packet, and not just the ones generated by their applications) aren't suitable.

Edit: OK, so after some research, I found out about the LD_PRELOAD trick, which could be used as a poor man's wrapper to intercept specific library functions (e.g. connect, sendto, etc.) and count/modify packets. Apparently the reason why there are not so many non-root tools based on this is because:

  • it's not useful for security purposes (it can be easily circumvented), and
  • most people during useful things with network already need root access anyway, so outside very specific applications tailored for learning, there is no real demand.

But this is technically feasible, in case any curious students are willing to develop such applications themselves.

Another technique would be to code a valgrind plug-in to deal with this and use valgrind to run the program. But it seems way overkill, so no sane people have done it.

Could someone more knowledgeable than me just confirm if my previous statements are correct?

  • fwiw it's actually CAP_NET_ADMIN that they need. You might try setting some file-based capabilities on the wireshark executable. Unless the problem you're trying to work around is that you don't have any root access at all. – Bratchley May 2 '14 at 21:09
  • Indeed, I do not have root access at all. I can eventually ask the administrators to install Debian packages, but not much more than that. – anol May 2 '14 at 21:14
  • It may be helpful to know exactly what the students are supposed to be learning, and how. This sounds like it may be a bit of an XY Problem. – depquid May 3 '14 at 21:22
  • Actually, a student asked me that question, phrased this way: "why are there no such non-root tools?". I could not find the answer, so I asked it here. – anol May 3 '14 at 21:35
  • It's not so hard to replace a couple of libc functions and call the real libc functions apart from registering the communication channels and intercepting the data. Why are you interested in that? – Pavel Šimerda May 4 '14 at 15:46
0

Assuming you're wanting to see the TCP/IP packets, the short answer is that you have to have root access to inspect packets because the actual packets are generated by the kernel, not the application.

  • And is there no way to use the wrapper program to intercept the system calls, similar to what valgrind does for malloc? – anol May 2 '14 at 20:55
  • In theory that's possible, but I'd imagine that it'd be complicated to implement and I'm not aware of such a tool. – depquid May 3 '14 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.