0

I am using an application called Splunk, which has 2 layers of data processing on separate systems. I can connect to both systems via putty and directly logging into the GUI.

Archiecture of the system attached

I want to monitor the output port on layer 1, and input port on layer 2 and find out the below information,

i. Raw data sent out of layer 1

ii. Raw data received into layer 2.

The two layers communicate using tcp.

I do not want to use an existing packet monitors/packet capture like tcpdump or winshark as I want to heavily customize the monitor to display various information. I want to write my own packet monitor in java

I want to know,

  1. If layer 2 is listening to layer 1, can my program connect to the same port and print the raw text being sent? - the protocol is TCP
  2. Is (1) possible for other protocols like udp, http and ftp?

(EDIT: Architecture attached

Info on the systems in case it is relevant,

  1. system 1 is VMWare(Linux Ubuntu 4.4.10) running on a Windows machine.

  2. System 2 is mac os.

Both systems have different IP addresses. I am connecting to both systems from the windows machine where vmware is running. The two systems connect to the same wifi. )

Divya Dutta
  • 7
  • 5

1 Answers1

0

There are some packet capture libraries written in Java, jpcap, jNetPcap, and Pcap4J. Both #1 and #2 are possible by these libraries, I think.

If you would pick Pcap4J I can help you. It's my library.

kaitoy
  • 1,545
  • 9
  • 16