netmon-rs

A network monitoring kernel module written in Rust.

Overview

netmon-rs is a Linux kernel module that registers a hook into the network filter, which provides the hex dump of network packets in the console. This module demonstrates the integration of Rust into kernel development for improved memory safety and performance.

Requirements

• Linux kernel development toolset with LLVM toolchain.
• Linux kernel v6.9.
• Applied netmon_linuk_kernel.patch patch. (TODO: add link to the patch from repo)
• Rust toolchain installed.

Installation

1. Prepare the kernel tools

Ensure you have all necessary tools for Linux Kernel development installed:

sudo apt install curl git fakeroot \
  build-essential ncurses-dev xz-utils libssl-dev \
  bc flex libelf-dev bison clang llvm lld

2. Prepare the kernel

Ensure you have Linux kernel v6.9 with applied patch. This patch contains the code to create the necessary bindings for the kernel module:

# Clone the Linux kernel repository
git clone https://github.com/torvalds/linux.git
cd linux
git checkout v6.9

# Apply the required patch
git apply linuk_kernel.patch

Set up the .config file with Rust support. You can either set it up by yourself, or copy one from the repo.

Ensure CONFIG_RUST=y option is enabled.

3. Build and install the kernel

make LLVM=1 -j$(nproc)
sudo make LLVM=1 modules_install
sudo make LLVM=1 install

Reboot into the new kernel.

4. Build netmon-rs module

# Clone this repository
git clone <link to repo>
cd netmon-rs

# Build the module
make

5. Load the module

sudo insmod netmon_rs.ko

Usage

After loading the module, you can investigate the results:

# Check if module is loaded
lsmod | grep netmon_rs

# Start monitoring the output
sudo dmesg -wH

Example Output

[Feb18 15:09] netmon: Rust Network Monitor (init) 

[  +7.908866] netmon: Tcp: 172.64.41.4:443 -> 192.168.254.135:54964 

[  +0.000112] netmon: Packet hex dump: 

[  +0.000051] netmon: 000000    00 50 56 2D BB 02 00 50 56 E4 7B 03 08 00 45 00  

[  +0.001117] netmon: 000010    00 28 80 13 00 00 80 06 26 48 AC 40 29 04 C0 A8  

[  +0.000876] netmon: 000020    FE 87 01 BB D6 B4 0E 35  

[  +0.013177] netmon: Tcp: 172.64.41.4:443 -> 192.168.254.135:54964 

[  +0.000100] netmon: Packet hex dump: 

[  +0.000038] netmon: 000000    00 50 56 2D BB 02 00 50 56 E4 7B 03 08 00 45 00  

[  +0.000813] netmon: 000010    00 4F 80 14 00 00 80 06 26 20 AC 40 29 04 C0 A8  

[  +0.000895] netmon: 000020    FE 87 01 BB D6 B4 0E 35 F0 E0 AF 42 56 4D 50 18  

[  +0.000907] netmon: 000030    FA F0 BB 5B 00 00 17 03 03 00 22 2B AE 82 A2 A1  

[  +0.000823] netmon: 000040    40 7F 63 E5 E3 20 BC 16 9A CE 61 F5 3D 65 33