dropping packets ?

jb_li · 04-13-2003, 09:59 AM

Hi Community,

following situation:
there is a gateway between my LAN and the Internet, and now the programming part starts. :-)
I want to write a packetsniffer sitting on my Gateway. (shouldn't be the problem). The sniffer should have the opportunity to filter out disliked packets compared with a small rulebase. Wrong dest-address or whatever ...
Does anyone of you knows a way to drop these packets out of a given stream, so they dont reach their acutal destinations ?
I have read about BPF and the IPtables headers, but i havent found usefull documents :-(

edit: i forgot to say ... the programm should run in the userspace. // prefered language is C

Thanks in advance,
h.d.

Tinkster · 04-13-2003, 03:04 PM

Why re-invent the wheel?
IPTables does a pretty good job,
all you need is to make a set of rules?

And if you really want to program your own
filter, don't start out trying to understand
IPTables, rather grab a TCP/IP programming
primer ;) and start from scratch.

Just my 2 cents.

Cheers,
TInk

jb_li · 04-13-2003, 04:13 PM

acutally my program should be a content-filter for http ... i don't think it is possible to set such rules with iptables.
i just want to run the sniffer, filtering the payload. This filter decide, whether there should be a full connection to the target host or not.
Maybe i can use iptables for dropping packets during the runtime ?!
If I would use just iptables doing this job, there is no dynamic effect. I dont have a real rulebase.

Tinkster · 04-13-2003, 04:28 PM

Quote:

content-filter for http

Now that sounds like a job for squid &
squid-guard or DanskGuardian :}

Cheers,
Tink

unSpawn · 04-13-2003, 04:34 PM

Maybe you should give an example of the payload (or classification) you want to filter for before I offer Snort as another alternative.

jb_li · 04-13-2003, 05:37 PM

How does Squid or Snort drop these packets ...?
Actually i want to write my own filter... :-)

Tinkster · 04-13-2003, 06:53 PM

Squid(guard) stops the http traffic from
reaching the machine that requested the
unwanted contents ... it doesn't "physically"
drop the packet.

As for writing your own filter: go for it ;)

Cheers,
Tink

P.S.: Here a few Links google spat out ...

http://www.scit.wlv.ac.uk/~jphb/comms/sockets.html
http://www.linuxjournal.com/article.php?sid=2333
http://www.developerweb.net/sock-faq/

jb_li · 04-14-2003, 11:18 AM

Thank you .. I will try it tonight