Implement network interface scan and pick default tap

Author: Leonardo Parente

cmd/pktvisord/NetworkInterfaceScan.h

@@ -0,0 +1,54 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#if __has_include(<ifaddrs.h>)
+#include <net/if.h>
+#include <ifaddrs.h>
+#else
+// System without ifaddrs
+#endif
+#include <string>
+
+#define INTERFACE_UP 0x1
+#define INTERFACE_LOOPBACK 0x8
+
+namespace visor {
+
+static inline std::string most_used_interface()
+{
+#if __has_include(<ifaddrs.h>)
+    struct ifaddrs *ifaddr;
+    if (getifaddrs(&ifaddr) == -1) {
+        return std::string();
+    }
+    std::string interface;
+    uint64_t most_used = 0;
+    for (struct ifaddrs *ifa = ifaddr; ifa != nullptr; ifa = ifa->ifa_next) {
+        if (ifa->ifa_addr == nullptr || (ifa->ifa_flags & IFF_LOOPBACK) || !(ifa->ifa_flags & IFF_UP)) {
+            continue;
+        }
+#if defined(AF_PACKET)
+        if (int family = ifa->ifa_addr->sa_family; family == AF_PACKET && ifa->ifa_data != nullptr) {
+#elif defined(AF_LINK)
+        if (int family = ifa->ifa_addr->sa_family; family == AF_LINK && ifa->ifa_da ta != nullptr) {
+#else
+        if (false) {
+#endif
+            uint32_t *stats = reinterpret_cast<uint32_t *>(ifa->ifa_data);
+            // first 4 bytes are txpackets and next 4 bytes are rxpackets
+            uint64_t packets = stats[0] + stats[1];
+            if (packets > most_used) {
+                most_used = packets;
+                interface = std::string(ifa->ifa_name);
+            }
+        }
+    }
+    freeifaddrs(ifaddr);
+    return interface;
+#else
+    return std::string();
+#endif
+}
+
+}

cmd/pktvisord/main.cpp

@@ -9,6 +9,7 @@
 #include "CrashpadHandler.h"
 #include "HandlerManager.h"
 #include "InputStreamManager.h"
+#include "NetworkInterfaceScan.h"
 #include "Policies.h"
 #include "handlers/static_plugins.h"
 #include "inputs/static_plugins.h"
@@ -571,7 +572,18 @@ int main(int argc, char *argv[])
         exit(EXIT_FAILURE);
     }
 
+    std::string iface;
     if (args["IFACE"]) {
+        iface = args["IFACE"].asString();
+    } else {
+
+        iface = visor::most_used_interface();
+        if (!iface.empty()) {
+            logger->info("Network Interface not set at startup, picked the most used interface: '{}'", iface);
+        }
+    }
+
+    if (!iface.empty()) {
         // pcap command line functionality, create default policy
         try {
             std::string bpf;
@@ -584,7 +596,7 @@ int main(int argc, char *argv[])
                 host_spec = args["-H"].asString();
             }
 
-            auto policy_str = fmt::format(default_tap_policy, args["IFACE"].asString(), host_spec, bpf, periods, sample_rate);
+            auto policy_str = fmt::format(default_tap_policy, iface, host_spec, bpf, periods, sample_rate);
             logger->debug(policy_str);
             svr->registry()->configure_from_str(policy_str);