libpcap (tcpdump) and netfilter (iptables)
Hi,
It seems that even if I drop some INPUT packets with iptables, tcpdump still sees these packets arriving on the ethernet interface.
Could anybody explain me a bit about this?
Thanks
Hi!
Short answer: Yes. tcpdump sees every packet.
Long answer:
http://www.google.hu/search?q=iptables+tcpdump
http://mydebian.blogdns.org/?p=85
Swifty
Pierre LEBRECH írta:
Quoted 15 lines
Hi,
It seems that even if I drop some INPUT packets with iptables, tcpdump still sees these packets arriving on the ethernet interface.
Could anybody explain me a bit about this?
Thanks
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi!
Short answer: Yes. tcpdump sees every packet.
Long answer:
http://www.google.hu/search?q=iptables+tcpdump
http://mydebian.blogdns.org/?p=85
Swifty
Pierre LEBRECH írta:
Quoted 15 lines
Hi,
It seems that even if I drop some INPUT packets with iptables, tcpdump still sees these packets arriving on the ethernet interface.
Could anybody explain me a bit about this?
Thanks
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi,
Quoted 6 lines · Pierre LEBRECH
Hi,
It seems that even if I drop some INPUT packets with iptables, tcpdump still sees these packets arriving on the ethernet interface.
Could anybody explain me a bit about this?
The pcap driver catch the packet before it's processed by netfilter. This is a known issue that has even been used in a rootkit PoC to communicate with the rootkit before the firewall drops the packet.
Quoted 7 lines
Thanks
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Regards,
Julien
Signature · 1 line
www.linuxwall.info
Quoted 6 lines · Julien Vehent
Hi,
Quoted 2 lines · Pierre LEBRECH
Hi,
Quoted 8 lines
Quoted 4 lines
It seems that even if I drop some INPUT packets with iptables, tcpdump still sees these packets arriving on the ethernet interface.
Could anybody explain me a bit about this?
The pcap driver catch the packet before it's processed by netfilter. This is a known issue that has even been used in a rootkit PoC to communicate with the rootkit before the firewall drops the packet.
You may call it a "known issue", I'd called a very useful and desirable feature for debugging network packet filters.
If you want to protect your machine against this issue, you could simply disable packet sockets, couldn't you?
Quoted 16 lines · Thomas Jacob
Quoted 6 lines · Julien Vehent
Hi,
Quoted 2 lines · Pierre LEBRECH
Hi,
Quoted 8 lines
Quoted 4 lines
It seems that even if I drop some INPUT packets with iptables, tcpdump still sees these packets arriving on the ethernet interface.
Could anybody explain me a bit about this?
The pcap driver catch the packet before it's processed by netfilter. This is a known issue that has even been used in a rootkit PoC to communicate with the rootkit before the firewall drops the packet.
Quoted 5 lines
You may call it a "known issue", I'd called a very useful and desirable feature for debugging network packet filters.
If you want to protect your machine against this issue, you could simply disable packet sockets, couldn't you?
This is right, "issue" may not be the right term to use here... Let's call it a "poorly documented feature". And in the case an attacker has access to the root, the pcap lib should be the least of your preoccupations...
Considering pcap is never install on production machines (at least, where I work), I never had to worry about this. :)
Quoted 6 lines
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Signature · 1 line
www.linuxwall.info