Sniffers

[gaf at BLU.ORG]

I have a situation at a client's client(I'll just refer to as the
client) where the client (eg. a state government in the midwest)  has
a system with their own home grown IP stack. They are sending messages
in the following sequence to a server that is dedicated. 
(Sending to a TCP Port):Connect->send 241 bytes->close.

On occasion, the server (Debian Linux 2.0 on Intel with a 2.0.34
kernel) reports an error. (Such as connection reset by peer). It
appears that their host is either not detecting errors, or ignoring
them. The network is not very good. Some segments are slow. There are
165 clients each sending no more than 1 transaction per minute. 

Does anyone have a recommendation for sniffer code that we can install
on the Linux server to watch all TCP traffic on a specified
port. While I can look in the various archives, I would prefer to
download code that someone has used before. 

If anyone is interested, my code is written as follows (all return values
are tested for error conditions). In this case, a better way would
have been to keep everything in a single select loop. My original code
was written that way. This was something the client was supposed to
do, but was not able, either based on programming resources or
politics. Because it was causing a delay in the project, I wrote the
code over a weekend. In this app, I don't like forking a child to
process a single 241 byte record. A pthreads solution would have been
better because I could spin a bunch of threads and have them wait on a
condition, which would eliminating the forking. Shared memory and
semaphores would also work. 

Create Socket
Bind socket to port
listen on socket.
signal(SIGCHLD, SIG_IGN); /* Prevent zombies */

for(;;) {
	select on listen port (no timeout).
	accept connection.
	fork child on connected socket.
	close connected socket. This is necessary otherwise sockets
				will be used up.
}

Child:
	rbytes = 0;
	/* Drain the pipe. Should never see more than 1
	 * record, but let's do it properly
	 */
	for(;;) {
		select on connected socket with timeout.
		rv = recv.
		if (rv > 0) {
			rbytes += rv;
			if (rbytes == 241) {
				process buffer.
				rbytes = 0;
				continue;
			}
		} else if (rv == 0) { /* normal EOF */
			if (rbytes > 0) 
				log error.
			close and exit.
		} else { /* rv < 0 */
			handle error.
			close and exit
		}
	}
	/* Should never get here */
	return 0;
}
***
Subcription/unsubscription/info requests: send e-mail with
"subscribe", "unsubscribe", or "info" on the first line of the
message body to discuss-request at blu.org (Subject line is ignored).