NetMon - Linux Network Monitoring Kernel Module

NetMon is a Linux kernel module that monitors network packet traffic on the host system. It exposes a character device interface and provides ioctl commands for querying packet statistics, resetting counters, and controlling monitoring state.

Features

• Collects packet-level statistics
• Tracks total packets, bytes, protocol distribution, and RX/TX counts
• Access via ioctl commands
• Character device interface exposed at /dev/netmon
• Supports start/stop monitoring and reset statistics

Topics

• linux
• kernel-module
• netfilter
• network-monitoring
• c-programming
• ioctl
• system-programming
• security

Sample Project Architecture

The project is organized around a small kernel/user-space architecture:

┌──────────────────────────────┐
│          User Space          │
│                              │
│  netmon CLI                  │
│  - stats                     │
│  - reset                     │
│  - start                     │
│  - stop                      │
│      │                       │
│      │ ioctl()               │
│      ▼                       │
│  /dev/netmon                 │
│                              │
└──────────────┬───────────────┘
               │
               ▼
┌──────────────────────────────┐
│       Kernel Space           │
│                              │
│  netmon_kernel.c             │
│  - Netfilter hook            │
│  - packet capture            │
│  - stats aggregation         │
│  - ioctl handlers            │
│                              │
└──────────────────────────────┘

Component Breakdown

• netmon_kernel.c – Linux kernel module that registers a Netfilter hook, inspects IPv4 packets, and updates traffic counters.
• netmon.c – User-space command-line utility for interacting with the kernel module via ioctl calls.
• netmon_ioctl.h – Shared ioctl command IDs and the packet statistics structure used between user and kernel space.
• Makefile – Builds the kernel module and the CLI tool.
• .gitignore – Ignores generated build artifacts such as compiled module files.

Build

From the module directory:

make

This should build netmon.ko.

Load

Load the kernel module with:

sudo insmod netmon.ko

If /dev/netmon is not created automatically, create it after checking the assigned major number in dmesg:

dmesg | tail

Then create the device node if required:

sudo mknod /dev/netmon c <major> 0
sudo chmod 666 /dev/netmon

Usage

This project is intended for Linux systems where kernel modules can be loaded with root privileges. The CLI communicates with the kernel module through the /dev/netmon device using ioctl calls.

Basic workflow

make
sudo insmod netmon.ko
sudo ./netmon start
./netmon stats
./netmon reset
sudo ./netmon stop
sudo rmmod netmon

Commands

• stats — query current packet statistics
• reset — reset all stored counters
• start — begin monitoring network traffic
• stop — stop monitoring traffic

Example output

====================================
        NETWORK MONITOR
====================================
Total packets : 142
Total bytes   : 18034
IPv4 packets  : 142

TCP packets   : 96
UDP packets   : 21
ICMP packets  : 5
Other packets : 20

RX packets    : 76
TX packets    : 66
RX bytes      : 9250
TX bytes      : 8784
====================================

Check

Verify the module is loaded and inspect kernel log output:

lsmod | grep netmon
dmesg | tail

Remove

Unload and remove the module:

sudo rmmod netmon

If you created /dev/netmon manually, you can remove it afterward:

sudo rm /dev/netmon

Example Workflow

make
sudo insmod netmon.ko
sudo ./netmon start
sudo ./netmon stats
sudo ./netmon reset
sudo ./netmon stop
sudo rmmod netmon

Development

• Keep kernel module sources under version control
• Ignore build artifacts with .gitignore
• Document ioctl interface and structure definitions in headers

Future Scope

This project is a foundation for Linux packet monitoring and can be extended in several directions:

• Add per-interface traffic statistics and filtering by network interface
• Support IPv6 packet capture and protocol analysis
• Add live dashboards or a monitoring daemon for real-time reporting
• Export metrics to CSV, JSON, or external monitoring systems
• Add rate limiting, packet sampling, and configurable monitoring policies
• Integrate with netlink, sysfs, or other modern Linux monitoring APIs
• Improve performance with lock optimization and safer concurrency handling
• Add module parameters for runtime configuration without recompilation
• Extend protocol support for more packet types and advanced traffic analysis

License

Include an appropriate license file such as LICENSE in the repository. For kernel modules, GPL is recommended if you want compatibility with the Linux kernel community.

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Your Name");
MODULE_DESCRIPTION("Netfilter-based network packet monitoring kernel module");