Re: Need to drop packets using tcpdump

[Rahmadi Trimananda <rtrimana () uci edu>]

Thank you! I am actually looking at the ingress hook of Nftables too right
now. Thanks for clarifying my understanding about tcpdump.

> On Feb 5, 2016 12:21 PM, "Guy Harris" <guy () alum mit edu> wrote:
> > On Feb 4, 2016, at 5:48 PM, Rahmadi Trimananda <rtrimana () uci edu> wrote:
> >
> > > I am a beginner user of tcpdump. What I want to do is to write my own
> > > version of tcpdump (or just extend it) to drop/reject network packets.
> > > AFAIK, tcpdump and libpcap can only sniff packets.
> >
> > You are correct.  The operating system mechanisms that tcpdump (and
everything else that uses libpcap/WinPcap) use for sniffing packets are
designed to passively sniff network traffic; they do not offer any
mechanism for inserting themselves into the networking stack so that all
packets must pass through the mechanism and can be dropped by the mechanism.
> > > Is there any available tool to do this?
> > >
> > > I am aware of netfilter's iptables and ebtables, but they only work if
the
> > > packets reach INPUT, FORWARD, or OUTPUT stage in the routing process.
What
> > > I need to do is sniff the packet directly (like what tcpdump does), and
> > > drop it right away
> >
> > Unfortunately, as per the above, the "sniff the packet directly" part of
tcpdump cannot be used, as the underlying mechanisms it uses passively tap
traffic, with no way to drop that traffic.
> > You *might* be able to...
> >
> > > if it matches my specified pattern, e.g. source, destination, port
number, etc.
> > ...reuse the "print the packet's contents" part, albeit with the actual
printing removed, and code to do the pattern matching replacing it.
> > What you will have to do is to find, *for the particular operating
system on which you will be doing this* (from "netfilter", I'm guessing
it's Linux), a mechanism that allows user-mode code (or kernel-mode code,
if you plan on stuffing this into the kernel) to examine all incoming
packets just before they're handed to the networking stack as received
packets and, based on the packet contents, pass them on to the networking
stack or drop them.
> > If, as I suspect, this is going to be done on Linux, would the netfilter
ingress hook:
> >         http://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks
> >
> > work for your purposes? It requires a 4.2 kernel or later, and may
require that a configuration option be turned on.
> > That page also refers to tc:
> >
> >         http://tldp.org/HOWTO/Traffic-Control-HOWTO/intro.html
> >
> >         http://lartc.org/manpages/tc.txt
> >
> >         https://en.wikipedia.org/wiki/Tc_(Linux)
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers