Network Monitoring Problem: Don't know where to start!

[dantinkakkar]

I want to build a network protocol analyzer, but I really don't know where to start. Obviously, I don't want the code in hand, I can think it up myself -- but the problem is a little more specific - where do I look at to get the IPs passing in and out? Like, do I need to communicate with the router or look for an operating system-related layer? I'm on Ubuntu 10.04 LTS (Lucid Lynx)...

And I know about things like WireShark and DarkStat -- using them is not what I want. I want something a little more customized for my needs, so can anyone help me out?

[EDIT: I don't want existing software. I'm doing something for my personal use]

[gusano79]

A direction you might look in is your network card's scandalously-named promiscuous mode.

[dantinkakkar]

A direction you might look in is your network card's scandalously-named promiscuous mode.

Ya, I guess you got it right there, but will Java be enough for accessing it? Like, CAN I do it in Java? How I'll do it is a separate journey altogether :D but can I do it?

[gusano79]

Ya, I guess you got it right there, but will Java be enough for accessing it? Like, CAN I do it in Java? How I'll do it is a separate journey altogether :D but can I do it?

Maybe someone who knows for sure can chime in; I don't think Java supports promiscuous sockets. If that's true, you'd have to come up with a native library and a JNI wrapper if you still wanted to use Java to analyze the traffic. For example, jNetPcap.

[dantinkakkar]

import java.io.*;
import java.net.*;
import java.util.*;
import static java.lang.System.out;

public class ListNets 
{
    public static void main(String args[]) throws SocketException {
        Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
        for (NetworkInterface netint : Collections.list(nets))
            displayInterfaceInformation(netint);
    }

    static void displayInterfaceInformation(NetworkInterface netint) throws SocketException {
        out.printf("Display name: %s\n", netint.getDisplayName());
        out.printf("Name: %s\n", netint.getName());
        Enumeration<InetAddress> inetAddresses = netint.getInetAddresses();
        for (InetAddress inetAddress : Collections.list(inetAddresses)) {
            out.printf("InetAddress: %s\n", inetAddress);
        }
        out.printf("\n");
     }
}

This displays the network interfaces available, and I'm somewhat sure that that's the thing being monitored. The code works perfectly, but how do I monitor them -- back to square one!?