Re: LIBPCAP: ULOG iptables capturing

[Guy Harris <guy () alum mit edu>]

On Sep 10, 2003, at 2:07 PM, Johan Verrept wrote:

> > That depends on the information supplied by the netlink stuff.  I
> > presume you get raw network-layer (IP, IPv6, IPX, etc.) packet data 
> > from
> > it.  It probably also supplies an indication of the network-layer
> > protocol, and perhaps other information.  What information does it
> > supply?
>
> I haven't tried, but I think it are indeed raw packets. At least, when 
> ulogd writes pcap files, it writes them with LINKTYPE_RAW.

If you mean LINKTYPE_RAW as in the LINKTYPE_RAW in "savefile.c", that 
is, indeed, raw network-layer packet data - meaning you get no 
link-layer information, meaning no network-layer packet type.

Is it only logging IP packets?  (I.e., no ARP, no non-IP network layer 
protocols such as IPX, etc.?)

> Except the packet itself, ulog provides a message structure containing 
> timestamp info, which iptables hook captured the data, input and 
> output device name, a MAC address and an arbitrary prefix which can be 
> controlled by the rule.

So is this similar to, for example, the OpenBSD pflog stuff?  With 
that, you get:

	an "address family" value for the packet (which the tcpdump and 
Ethereal code for pflog assumes is either AF_INET or AF_INET6, i.e. 
IPv4 or IPv6);

	an interface name (presumably the interface on which the packet was 
received);

        a rule number;

        a reason code saying why the packet was logged;

        the action taken by PF on the packet (passed, dropped, scrubbed);

        a direction value (inout, in, out);

along with a time stamp (the standard libpcap-format time stamp).

If so, I'd be inclined to use the timestamp info for a libpcap 
timestamp, and supply the rest of the information in a 
DLT_ULOG/LINKTYPE_ULOG header, unprocessed.  (Is that information 
fixed-length or variable-length?)

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe