redhound 2.0.0.rc1 → 2.0.0.rc2

data/lib/redhound/analysis/tcp_reassembler.rb

@@ -22,7 +22,7 @@ module Redhound
             recognized = packet.layers.find { |item| (candidate = @registry.protocols[item.protocol]) && candidate <= StreamDissector }
             klass = recognized ? @registry.protocols[recognized.protocol] : flow.applications[1 - direction]&.class
           end
-          flow.applications[direction] = klass.new(registry: @registry, max_bytes: @stream_bytes) if klass && klass <= StreamDissector
+          flow.applications[direction] = create_application(klass, flow, direction, layer) if klass && klass <= StreamDissector
           application = flow.applications[direction]
         end
         TcpAnalysis.update(flow, direction, stream, layer, packet.timestamp_ns)
@@ -47,7 +47,7 @@ module Redhound
         elsif flow.streams.compact.size == 2 && flow.streams.compact.all?(&:fin_seen?)
           finish_flow(flow, packet)
         elsif stream.fin
-          attach(packet, application.on_close(flow, direction)) if application
+          attach(packet, invoke(flow, direction, application, :on_close)) if application
           flow.closed_ns ||= packet.timestamp_ns if flow.streams.compact.size == 2 && flow.streams.compact.all?(&:fin)
         end
       end
@@ -59,23 +59,16 @@ module Redhound
             gap = Layer.new(:tcp, 0, 0, 0).diagnose(:warning, :reassembly_gap, "#{origin} TCP bytes missing")
             packet&.[](:tcp)&.diagnose(:warning, :reassembly_gap, gap.diagnostics.first.message)
             completed << gap unless packet
-            layers = application ? application.on_gap(flow, direction, origin) : Array.new #: Array[Layer]
+            flow.probes[direction].clear
+            flow.probe_disabled[direction] = false
+            application = flow.applications[direction]
+            layers = application ? invoke(flow, direction, application, :on_gap, origin) : Array.new #: Array[Layer]
             completed.concat(layers)
             attach(packet, layers) if packet
             next
           end
           @follow&.write(flow, direction, data)
-          layers = if application
-                     begin
-                       application.on_data(flow, direction, data, origin)
-                     rescue StandardError => error
-                       raise if ENV['REDHOUND_STRICT'] == '1'
-                       application.on_gap(flow, direction, data.bytesize)
-                       [Layer.new(application.class.protocol_id, 0, 0, 0).diagnose(:error, :dissector_bug, "#{error.class}: #{error.message}")]
-                     end
-                   else
-                     Array.new
-                   end #: Array[Layer]
+          layers = application_data(flow, direction, data, origin, packet)
           attach(packet, layers) if packet
           completed.concat(layers)
         end
@@ -83,6 +76,63 @@ module Redhound
       ensure
         stream.clear_deliveries
       end
+      # @rbs (Flow flow, Integer direction, String data, Integer origin, Packet? packet) -> Array[Layer]
+      def application_data(flow, direction, data, origin, packet)
+        application = flow.applications[direction]
+        probe = flow.probes[direction]
+        unless application
+          return [] unless @protocol_streams && !flow.probe_disabled[direction]
+          sample = (probe.map(&:first).join + data.byteslice(0, 128)).byteslice(0, 128) #: String
+          ctx = Context.new(Packet.new(sample), registry: @registry)
+          ctx.layers << Layer.new(:tcp, 0, 0, sample.bytesize)
+          klass = @registry.heuristic(:tcp, ctx, ctx.cursor)
+          if klass && klass <= StreamDissector
+            diagnostic_layer = packet&.[](:tcp) || Layer.new(:tcp, 0, 0, 0)
+            application = flow.applications[direction] = create_application(klass, flow, direction, diagnostic_layer)
+            return packet ? [] : [diagnostic_layer] unless application
+            if packet
+              position = packet.layers.index { |layer| layer.protocol == :tcp && !layer.embedded }
+              packet.layers.slice!(position + 1, packet.layers.size) if position
+            end
+          else
+            if sample.bytesize < 128 && probe.sum { |bytes, _frame| bytes.bytesize * 2 + 128 } + data.bytesize * 2 + 128 <= @stream_bytes
+              probe << [data.dup, origin]
+            else
+              probe.clear
+              flow.probe_disabled[direction] = true
+            end
+            return []
+          end
+        end
+        chunks = probe + [[data, origin]]
+        probe.clear
+        chunks.flat_map { |bytes, frame| invoke(flow, direction, application, :on_data, bytes, frame) }
+      rescue StandardError => error
+        [application_error(flow, direction, :tcp, error)]
+      end
+      # @rbs (untyped klass, Flow flow, Integer direction, Layer layer) -> untyped
+      def create_application(klass, flow, direction, layer)
+        klass.new(registry: @registry, max_bytes: @stream_bytes)
+      rescue StandardError => error
+        layer.diagnostics.concat(application_error(flow, direction, klass.protocol_id, error).diagnostics)
+        nil
+      end
+      # @rbs (Flow flow, Integer direction, untyped application, Symbol method, *untyped arguments) -> Array[Layer]
+      def invoke(flow, direction, application, method, *arguments)
+        layers = application.public_send(method, flow, direction, *arguments)
+        raise TypeError, 'stream callback must return an array of Layers' unless layers.is_a?(Array) && layers.all? { |layer| layer.is_a?(Layer) }
+        layers
+      rescue StandardError => error
+        [application_error(flow, direction, application.class.protocol_id, error)]
+      end
+      # @rbs (Flow flow, Integer direction, Symbol protocol, StandardError error) -> Layer
+      def application_error(flow, direction, protocol, error)
+        raise error if ENV['REDHOUND_STRICT'] == '1'
+        flow.applications[direction] = nil
+        flow.probes[direction].clear
+        flow.probe_disabled[direction] = true
+        Layer.new(protocol, 0, 0, 0).diagnose(:error, :dissector_bug, "#{error.class}: #{error.message}")
+      end
       # @rbs (Packet packet, Array[Layer] layers) -> void
       def attach(packet, layers)
         layers.each do |layer|
@@ -100,21 +150,23 @@ module Redhound
             stream.flush_gap
             completed.concat(deliver(flow, direction, stream, application, packet))
           end
+          application = flow.applications[direction]
           if application
-            layers = application.on_close(flow, direction)
+            layers = invoke(flow, direction, application, :on_close)
             attach(packet, layers) if packet
             completed.concat(layers)
           end
           stream.release
         end
         flow.http_methods.each(&:clear)
+        flow.probes.each(&:clear)
         flow.closed_ns ||= packet ? packet.timestamp_ns : flow.last_ns
         completed
       end
       # @rbs (FlowTable flows, Packet packet) -> void
       def enforce_limit(flows, packet)
         while flows.tcp_bytesize > @max_bytes
-          flow = flows.evict
+          flow = flows.evict(:tcp)
           break unless flow
           packet.layers.last.diagnose(:warning, :reassembly_gap, 'TCP reassembly memory limit exceeded')
         end

data/lib/redhound/analysis/tcp_stream.rb

@@ -21,6 +21,9 @@ module Redhound
       # @rbs (Integer sequence, String data, ?syn: bool, ?fin: bool, ?frame: Integer) -> Array[String]
       def push(sequence, data, syn: false, fin: false, frame: 0)
         @diagnostics, @deliveries, @gap_lengths = [], [], []
+        if @base_seq && ((syn && sequence == @base_seq) || (fin && Util::Seq.lt((sequence + data.bytesize) % Util::Seq::MOD, next_sequence)))
+          @diagnostics << :retransmission
+        end
         unless @base_seq
           @base_seq = sequence
           @expected = syn ? 1 : 0
@@ -115,7 +118,9 @@ module Redhound
       # @rbs () -> void
       def trim_history
         # Previously delivered bytes share the stream's bounded budget with holes.
-        limit = [@max_bytes - @queue.sum { |item| item[1].bytesize + 128 }, 0].max
+        # Ruby grows mutable String buffers geometrically. Reserve twice their
+        # length plus object storage so capacity also stays inside the budget.
+        limit = [(@max_bytes - @queue.sum { |item| item[1].bytesize * 2 + 168 } - 40) / 2, 0].max
         excess = @history.bytesize - limit
         if excess.positive?
           @history = @history.byteslice(excess..) #: String
@@ -123,7 +128,7 @@ module Redhound
         end
       end
       # @rbs () -> Integer
-      def bytesize = @history.bytesize + @queue.sum { |item| item[1].bytesize + 128 }
+      def bytesize = (@history.empty? ? 0 : @history.bytesize * 2 + 40) + @queue.sum { |item| item[1].bytesize * 2 + 168 }
       # @rbs () -> bool
       def pending? = !@queue.empty? || (!@fin && !@fin_offset.nil?)
       # @rbs () -> bool

data/lib/redhound/analysis.rb

@@ -28,7 +28,16 @@ module Redhound
         @follow = follow ? Output::Follow.new(follow) : nil
         @tcp_reassembler = TcpReassembler.new(registry: registry, max_bytes: [tcp_bytes, max_state_bytes].min,
                                              stream_bytes: stream_bytes, protocol_streams: protocol_streams, follow: @follow)
-        @flows.on_remove = ->(flow) { @tcp_reassembler.finish_flow(flow) }
+        @removed_gaps, @removed_incomplete, @removed_bugs = 0, 0, 0
+        @flows.on_remove = lambda do |flow|
+          @tcp_reassembler.finish_flow(flow).each do |layer|
+            layer.diagnostics.each do |diagnostic|
+              @removed_gaps += 1 if diagnostic.code == :reassembly_gap
+              @removed_incomplete += 1 if diagnostic.code == :truncated
+              @removed_bugs += 1 if diagnostic.code == :dissector_bug
+            end
+          end
+        end
         specs = stats.uniq
         raise ConfigurationError, 'too many statistics specifications (maximum 64)' if specs.size > 64
         row_limit = [100_000, [((128 << 20) / [specs.size, 1].max) / 1024, 1].max].min
@@ -103,6 +112,9 @@ module Redhound
       # @rbs (untyped err) -> void
       def snapshot(err)
         @statistics.each { |stat| stat.format(err) }
+        err.puts("#{@removed_gaps} TCP reassembly_gap events during flow removal") if @removed_gaps.positive?
+        err.puts("#{@removed_incomplete} truncated application PDUs during flow removal") if @removed_incomplete.positive?
+        err.puts("#{@removed_bugs} dissector_bug events during flow removal") if @removed_bugs.positive?
         err.puts("#{@flows.evicted} flows evicted; #{@flows.expired} flows expired") if @flows.evicted.positive? || @flows.expired.positive?
         err.puts("#{@ip_reassembler.evicted} fragmented datagrams evicted; #{@ip_reassembler.expired} expired") if @ip_reassembler.evicted.positive? || @ip_reassembler.expired.positive?
       end
@@ -118,11 +130,27 @@ module Redhound
           end
           @flows.account(flow)
         end
+        incomplete = @ip_reassembler.finish
+        err.puts("#{incomplete} incomplete IP datagrams: reassembly_gap at EOF") if incomplete.positive?
         @follow&.format(out)
         snapshot(err)
       ensure
+        original_error = $!
         @finished = true
-        @follow&.close
+        @flows.values.each do |flow|
+          flow.streams.compact.each(&:release)
+          flow.applications.fill(nil)
+          flow.http_methods.each(&:clear)
+          flow.probes.each(&:clear)
+          flow.closed_ns ||= flow.last_ns
+          @flows.account(flow)
+        end
+        @ip_reassembler.finish
+        begin
+          @follow&.close
+        rescue StandardError
+          raise unless original_error
+        end
       end
     end
   end

data/lib/redhound/capture/bsd/bpf_device.rb

@@ -51,7 +51,10 @@ module Redhound
         # @rbs (?timeout: Numeric?) -> Packet?
         def next_packet(timeout: nil)
           deadline = deadline_for(timeout)
+          polled = false
           until @stopped || @closed
+            return nil if polled && deadline && Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            polled = true
             if @offset >= @records.bytesize
               return nil unless wait_readable(@device, deadline)
               result = @device.read_nonblock(@buffer_size, exception: false)

data/lib/redhound/capture/bsd/ifreq.rb

@@ -0,0 +1,41 @@
+# rbs_inline: enabled
+# frozen_string_literal: true
+
+module Redhound
+  module Capture
+    module Bsd
+      # macOS interface metadata can be queried without opening a BPF device.
+      module Ifreq
+        SIOCGIFMTU = 0xc0206933 # Verified against sys/sockio.h; sizeof(ifreq) is 32.
+
+        # @rbs (String name, index: Integer, flags: Integer, link_address: String?) -> Interface
+        def self.interface(name, index:, flags:, link_address:)
+          raise ArgumentError, 'invalid interface name' if name.bytesize >= 16 || name.include?("\0")
+
+          socket = ::Socket.new(::Socket::AF_INET, ::Socket::SOCK_DGRAM, 0)
+          bytes = [name].pack('a16') + "\0" * 16
+          begin
+            socket.ioctl(SIOCGIFMTU, bytes)
+          ensure
+            socket.close
+          end
+          mtu = bytes.unpack1('i', offset: 16) #: Integer
+          mac = nil # @rbs String?
+          if link_address && link_address.bytesize >= 8
+            name_length = link_address.getbyte(5) #: Integer
+            address_length = link_address.getbyte(6) #: Integer
+            if address_length == 6 && link_address.bytesize >= 8 + name_length + address_length
+              mac_bytes = link_address.byteslice(8 + name_length, address_length) #: String
+              mac_values = mac_bytes.unpack('C6') #: Array[Integer]
+              mac = mac_values.map { |value| format('%02x', value) }.join(':')
+            end
+          end
+          linktype = (flags & 8).positive? || name.start_with?('utun') ? 0 : 1
+          Interface.new(name:, index:, flags:, mtu:, mac:, linktype:)
+        rescue Errno::ENXIO, Errno::ENODEV
+          raise InterfaceNotFound, "interface #{name.inspect} not found"
+        end
+      end
+    end
+  end
+end

data/lib/redhound/capture/file_source.rb

@@ -6,6 +6,61 @@ module Redhound
   module Capture
     # @api private
     class FileSource < Source
+      class ReadStopped < StandardError; end
+
+      # @api private
+      class FileInput
+        # @rbs (::File io) -> void
+        def initialize(io)
+          @io, @buffer, @offset = io, ''.b, 0
+        end
+
+        # @rbs (Integer length) -> String?
+        def read(length)
+          ending = @offset + length
+          if ending <= @buffer.bytesize
+            result = @buffer.byteslice(@offset, length)
+            @offset = ending
+            return result
+          end
+          result = @buffer.byteslice(@offset..) || ''.b
+          while result.bytesize < length
+            begin
+              @buffer = @io.readpartial(65_536)
+            rescue EOFError
+              @buffer, @offset = ''.b, 0
+              return result.empty? ? nil : result
+            end
+            amount = [length - result.bytesize, @buffer.bytesize].min #: Integer
+            result << @buffer.byteslice(0, amount)
+            @offset = amount
+          end
+          result
+        end
+      end
+      private_constant :FileInput
+
+      # Nonregular inputs need bounded polling so Source#stop can interrupt an idle pipe.
+      class StreamInput
+        # @rbs (IO io, Source source) -> void
+        def initialize(io, source)
+          @io, @source = io, source
+        end
+
+        # @rbs (Integer length) -> String?
+        def read(length)
+          loop do
+            raise ReadStopped if @source.stopped?
+            next unless IO.select([@io], nil, nil, 0.1)
+
+            part = @io.read_nonblock(length, exception: false)
+            next if part == :wait_readable
+
+            return part
+          end
+        end
+      end
+
       attr_reader :reader
 
       # @rbs (untyped input, ?filter: String?) -> void
@@ -14,15 +69,27 @@ module Redhound
         @owned = input.is_a?(String) && input != '-'
         @io = input.is_a?(String) ? (input == '-' ? $stdin : ::File.open(input, 'rb')) : input
         @io.binmode if @io.respond_to?(:binmode)
-        magic = File::Format.read_exact(@io, 4)
+        regular = @io.is_a?(IO) && @io.stat.file?
+        reader_io = if @owned && regular
+                      FileInput.new(@io)
+                    elsif @io.is_a?(IO) && !regular
+                      StreamInput.new(@io, self)
+                    else
+                      @io
+                    end
+        @stream = reader_io.is_a?(StreamInput)
+        @packets = nil # @rbs Thread::SizedQueue[Packet | StandardError]?
+        @reader_thread = nil # @rbs Thread?
+        magic = File::Format.read_exact(reader_io, 4)
         @reader = if magic == File::Format::PCAPNG_MAGIC
-                    File::PcapngReader.new(@io, magic)
+                    File::PcapngReader.new(reader_io, magic)
                   elsif File::Format::PCAP_MAGICS.key?(magic)
-                    File::PcapReader.new(@io, magic)
+                    File::PcapReader.new(reader_io, magic)
                   else
                     raise FileFormatError, 'unrecognized capture file magic'
                   end
         @filter_expression = filter
+        @filter_program = nil # @rbs Filter::Program?
         @filters = {} #: Hash[Integer, untyped]
         @filters[@reader.linktype] = Filter.compile(filter, linktype: @reader.linktype) if filter
       rescue StandardError, Interrupt
@@ -47,8 +114,18 @@ module Redhound
       def next_packet(timeout: nil)
         return nil if @stopped || @closed
 
-        while (packet = @reader.next_packet)
+        deadline = deadline_for(timeout)
+        polled = false
+        until @stopped || @closed
+          return nil if polled && deadline && Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+          polled = true
+          remaining = deadline && [deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), 0].max
+          packet = read_packet(remaining)
+          return nil if packet == :wait_readable
+          break unless packet
+
           @capture_stats.received += 1
+          next if @filter_program && !@filter_program.match?(packet)
           if @filter_expression
             program = (@filters[packet.linktype] ||= Filter.compile(@filter_expression, linktype: packet.linktype))
             next unless program.match?(packet)
@@ -58,6 +135,15 @@ module Redhound
         end
         stop
         nil
+      rescue ReadStopped
+        nil
+      end
+
+      # @rbs (Filter::Program? program) -> void
+      def attach_filter(program)
+        @filter_expression = nil
+        @filters.clear
+        @filter_program = program
       end
 
       # @rbs () -> Integer
@@ -71,13 +157,58 @@ module Redhound
         @reader.respond_to?(:statistics?) && @reader.statistics? ? @reader.stats : super
       end
 
+      # @rbs () -> void
+      def stop
+        super
+        @packets&.close
+      end
+
       # @rbs () -> void
       def close
         return if @closed
 
         super
+        @reader_thread&.join(0.2)
         @io.close if @owned
       end
+
+      private
+
+      # A single bounded worker preserves partial records across caller timeouts.
+      # @rbs (Numeric? timeout) -> (Packet | nil | :wait_readable)
+      def read_packet(timeout)
+        return @reader.next_packet unless @stream
+
+        unless @packets
+          queue = Thread::SizedQueue.new(1) #: Thread::SizedQueue[Packet | StandardError]
+          @packets = queue
+          @reader_thread = Thread.new do
+            begin
+              while !stopped? && (packet = @reader.next_packet)
+                queue << packet
+              end
+            rescue ReadStopped, ClosedQueueError
+              nil
+            rescue StandardError => error
+              begin
+                queue << error
+              rescue ClosedQueueError
+                nil
+              end
+            ensure
+              queue.close
+            end
+          end
+        end
+        queue = @packets #: Thread::SizedQueue[Packet | StandardError]
+        result = queue.pop(timeout: timeout && Float(timeout))
+        raise result if result.is_a?(StandardError)
+
+        return result if result
+        return nil if queue.closed?
+
+        :wait_readable
+      end
     end
   end
 end

data/lib/redhound/capture/interface.rb

@@ -37,11 +37,15 @@ module Redhound
 
       # @rbs () -> Array[Interface]
       def self.all
-        Socket.getifaddrs.uniq(&:name).map do |address|
+        addresses = Socket.getifaddrs
+        addresses.uniq(&:name).map do |address|
           index = address.ifindex || 0
           interface = new(name: address.name, index:, flags: address.flags)
           if RUBY_PLATFORM.include?('linux')
             Linux::Ifreq.interface(address.name, index:)
+          elsif RUBY_PLATFORM.include?('darwin')
+            link = addresses.find { |entry| entry.name == address.name && entry.addr&.afamily == 18 }
+            Bsd::Ifreq.interface(address.name, index:, flags: address.flags, link_address: link&.addr&.to_sockaddr)
           else
             interface
           end

data/lib/redhound/capture/linux/packet_socket.rb

@@ -32,6 +32,7 @@ module Redhound
           end
           @socket.bind(SockaddrLL.new(index: @interface.index).to_sockaddr)
           prime_timestamp
+          warn_vlan_offload
           if direction == :in
             begin
               @socket.setsockopt(Constants::SOL_PACKET, Constants::PACKET_IGNORE_OUTGOING, [1].pack('i'))
@@ -50,11 +51,16 @@ module Redhound
         # @rbs (?timeout: Numeric?) -> Packet?
         def next_packet(timeout: nil)
           deadline = deadline_for(timeout)
+          polled = false
           until @stopped || @closed
-            return nil unless wait_readable(@socket, deadline)
-
+            return nil if polled && deadline && Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            polled = true
             result = @socket.recvfrom_nonblock(Constants::RECEIVE_SIZE, exception: false)
-            next if result == :wait_readable
+            if result == :wait_readable
+              return nil unless wait_readable(@socket, deadline)
+
+              next
+            end
 
             data, address_info = result
             address = SockaddrLL.parse(address_info.to_sockaddr)
@@ -78,10 +84,7 @@ module Redhound
         def attach_filter(program)
           instructions = program ? program.instructions : [[0x06, 0, 0, receive_snaplen]] #: Array[[Integer, Integer, Integer, Integer]]
           Filter::BPF::Validator.validate!(instructions)
-          instructions = instructions.map do |instruction|
-            code, jt, jf, k = instruction #: [Integer, Integer, Integer, Integer]
-            [code, jt, jf, code == 0x06 && k.positive? ? receive_snaplen : k]
-          end
+          instructions = receive_filter(instructions)
           packed = instructions.map { |instruction| instruction.pack('S C C L') }.join
           @socket.setsockopt(::Socket::SOL_SOCKET, Constants::SO_ATTACH_FILTER, [instructions.size, packed].pack('S x6 P'))
         end
@@ -112,6 +115,47 @@ module Redhound
 
         protected
 
+        # Positive filter returns select packets; the source applies its configured snaplen.
+        # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> Array[[Integer, Integer, Integer, Integer]]
+        def receive_filter(instructions)
+          unless instructions.any? { |instruction| instruction[0] == 0x16 }
+            return instructions.map do |code, jt, jf, k|
+              [code, jt, jf, code == 0x06 && k.positive? ? receive_snaplen : k]
+            end
+          end
+
+          assembler = Filter::BPF::Assembler.new
+          labels = instructions.map { assembler.label }
+          accepted, rejected = assembler.label, assembler.label
+          instructions.each_with_index do |(code, jt, jf, k), index|
+            assembler.mark(labels.fetch(index))
+            if code == 0x16
+              assembler.branch(0x15, 0, rejected, accepted)
+            elsif code == 5
+              assembler.jump(labels.fetch(index + 1 + k))
+            elsif Filter::BPF::Validator::JUMPS.include?(code)
+              assembler.branch(code, k, labels.fetch(index + 1 + jt), labels.fetch(index + 1 + jf))
+            else
+              assembler.emit(code, code == 6 && k.positive? ? receive_snaplen : k)
+            end
+          end
+          assembler.mark(accepted)
+          assembler.emit(6, receive_snaplen)
+          assembler.mark(rejected)
+          assembler.emit(6, 0)
+          result = assembler.assemble
+          Filter::BPF::Validator.validate!(result)
+          result
+        end
+
+        # @rbs () -> void
+        def warn_vlan_offload
+          return unless instance_of?(PacketSocket) && [1, 276].include?(@linktype) && !@interface.loopback?
+
+          name = @interface.name == 'any' ? '<interface>' : @interface.name
+          warn "redhound: socket capture cannot restore stripped VLAN tags; disable receive VLAN offload with ethtool -K #{name} rxvlan off on the receiving interface"
+        end
+
         # @rbs () -> void
         def close_resources
           @socket.close if @socket && !@socket.closed?
@@ -135,8 +179,8 @@ module Redhound
           @socket.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_RCVBUF, [buffer_size].pack('i'))
           begin
             @socket.setsockopt(::Socket::SOL_SOCKET, Constants::SO_RCVBUFFORCE, [buffer_size].pack('i'))
-          rescue Errno::EPERM, Errno::EACCES, Errno::ENOPROTOOPT
-            # SO_RCVBUF already applied without CAP_NET_ADMIN.
+          rescue Errno::EPERM, Errno::EACCES, Errno::ENOPROTOOPT => error
+            warn "redhound: SO_RCVBUFFORCE unavailable (#{error.message}); using SO_RCVBUF with the system limit"
           end
         end
 

data/lib/redhound/capture/linux/tpacket_v3.rb

@@ -11,7 +11,10 @@ module Redhound
         # @rbs (?timeout: Numeric?) -> Packet?
         def next_packet(timeout: nil)
           deadline = deadline_for(timeout)
+          polled = false
           until @stopped || @closed
+            return nil if polled && deadline && Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            polled = true
             unless @pending_count.positive?
               base = @current_block * @block_size
               unless (u32(base + 8) & Constants::TP_STATUS_USER).positive?
@@ -102,6 +105,8 @@ module Redhound
           begin
             Warning[:experimental] = false
             @ring = IO::Buffer.map(@socket, @block_size * @block_count, 0)
+          rescue ArgumentError => error
+            raise UnsupportedPlatform, "Ruby #{RUBY_VERSION} IO::Buffer.map cannot map a packet socket: #{error.message}"
           ensure
             Warning[:experimental] = experimental
           end

data/lib/redhound/capture.rb

@@ -12,6 +12,7 @@ require_relative 'capture/linux/cooked'
 require_relative 'capture/linux/packet_socket'
 require_relative 'capture/linux/tpacket_v3'
 require_relative 'capture/bsd/constants'
+require_relative 'capture/bsd/ifreq'
 require_relative 'capture/bsd/bpf_device'
 require_relative 'file/format'
 require_relative 'file/pcap_reader'
@@ -35,10 +36,10 @@ module Redhound
                  when :socket then Linux::PacketSocket.new(interface:, **options)
                  when :ring then Linux::TPacketV3.new(interface:, **options)
                  when :auto
-                   if RUBY_PLATFORM.include?('x86_64')
+                   if RUBY_PLATFORM.start_with?('x86_64-', 'aarch64-', 'arm64-')
                      begin
                        Linux::TPacketV3.new(interface:, **options)
-                     rescue SystemCallError, IO::Buffer::AccessError, IO::Buffer::AllocationError, NotImplementedError => error
+                     rescue SystemCallError, IO::Buffer::AccessError, IO::Buffer::AllocationError, NotImplementedError, UnsupportedPlatform => error
                        warn "redhound: ring backend unavailable (#{error.message}); using socket"
                        Linux::PacketSocket.new(interface:, **options)
                      end

data/lib/redhound/cli/command.rb

@@ -16,7 +16,7 @@ module Redhound
         elsif values[:version]
           out.puts("Redhound #{VERSION}")
         elsif values[:list_interfaces]
-          Capture.interfaces.each { |i| out.puts("#{i.index}.#{i.name} [#{i.flags & 1 != 0 ? 'Up' : 'Down'}]#{i.mac ? " #{i.mac}" : ''}#{i.mtu ? " mtu #{i.mtu}" : ''}") }
+          Capture.interfaces.each { |i| out.puts(i.to_s) }
         elsif values[:list_protocols]
           Registry.default.protocols.each_value do |klass|
             fields = klass.compiled_header&.definitions&.map(&:name) || []