0

As far as I understand, nosy is an IEEE1394 FireWire packet sniffer for linux. I'm unsure as how to run it. It can be found in the linux repo.

When I cd to /lib/modules/4.15.0-55-generic/kernel/drivers/firewire, there's a file called nosy.ko, which is a linux kernel module. I tried sudo insmod nosy.ko and loaded the module (can see it in the output of lsmod) but nothing happened.

Kernel: 4.15.0-55-generic

Distro: Ubuntu 18.04.2 LTS (bionic)

Any help is appreciated.

  • @user535733 changed the title. It's included with ubuntu, but how do I run / make use of it, so I can sniff FireWire packets? – wr43th13 Aug 2 at 15:35
  • It is unclear why you think nosy.ko is a packet sniffer. You might as well say it's a bread slicer or a coffee maker, which makes no sense either way. – mikewhatever Aug 2 at 16:41
  • @mikewhatever That's what its developers call it. See here. The term is also used by wikipedia when defining a packet analyzer. Can you please help me with my problem? – wr43th13 Aug 2 at 16:49
  • Apparently, there is a "userspace frontend, called nosy-dump", so that's what you "run". You are welcome to read the article: lwn.net/Articles/397005. – mikewhatever Aug 2 at 16:59
1

Following up on @mikewhatever's comment, and this thread, I ran make in the tools/firewire subdirectory of the kernel source tree. If there are no errors (see below) that will result in a nosy-dump executable that you can run. Your nosy device might not be /dev/nosy as written in the code so you can change that before compiling or use the -d flag. In my case the devices are fw0 and fw1, since I'm using a laptop PCI card with 2 FW interfaces. Check out the code for the rest of the flags. I don't get any output upon running nosy-dump, but that's another problem.

If you could compile then don't read any further.

I got an error saying that uapi/linux/types.h could not be found. I had to add an extra include path in the MakeFile, on line 9, so that it looks like nosy-dump : CFLAGS = -Wall -O2 -g -I /usr/src/linux-headers-4.15.0-55-generic/include/uapi. Of course, this path depends on the kernel and distro.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.