Network Packet Inspector in Mac OSX

Question

I'm trying to create a network packet inspector.

I know you can do this with libpcap, but it's not a sniffer, i need to forge network packet, before it was sent on network. (sending via socks server)

I found 2 ways to do this :

• Using an NKE. (Network Kernel Extension)
• Using a DYLD_INSERT_LIBRARIES to insert a library to hook network function.

Which method do you think is the best ?

Answer 1

Neither, use a tun/tap device: http://tuntaposx.sourceforge.net/

You'll need to route the traffic to that device, modify it, then send it back. You can do this with firewall rules. There are lots of examples of using tun/tap all over the open-source world, it isn't hard.

Advantage: it's a kernel extension, but a standard kernel extension, and therefore you don't need to worry about debugging it.