This is a fairly simple modification of the standard SK98 driver from
Linux so that it can be used as a high-bandwidth sniffer.  Packets
reach userspace zero-copy, and no per-packet system calls are
required.  Depending on the packet size distribution, you can sniff up
to about 700Mbit/s without dropping on fairly ordinary hardware.  Of
course, doing anything with that much data is another matter, but hey.


Building:

-- First, build the kernel module.  For any 2.6 kernel, just going
	make -f Makefile.26 should do the required thing.  For a 2.4
	series kernel (which isn't at all well tested), do ln -s
	/usr/src/linux-2.4.21/include include ; make -f Makefile.24
	(assuming you want to build against the kernel source in
	/usr/src/linux-2.4.21).
-- Then, build userspace.  Go to the uspace directory, and run make

Running:

-- Load the kernel module.  In a normal configuration, where you just
   have a single piece of fibre running into the back of the card
   (e.g. from a SPANS port), no arguments are required.  If you're
   using actual passive optical taps, you'll need to use separate bits
   of fibre for each direction on the link being monitored.  Plug one
   into each of the two rx ports on the back of the card, and then
   load it with the arguments:

   AutoNeg_A=Off DupCap_A=Off AutoNeg_B=Off DupCap_B=Off Role_A=Slave Role_B=Slave RlmtMode=DualNet

   In either configuration, Moderation=Static may give some
   performance boost.  YMMV.

-- Enable the interfaces:

   /sbin/ifconfig eth2 up promisc
   /sbin/ifconfig eth3 up promisc

-- Start the client:

   uspace/dumper /path/to/output/file

-- Wait.  Calibrating the sk98's onboard clock against the system
   clock can sometimes take a minute or two.


For this to be really useful, you probably want to write your own
dumper.

Have fun.

