Hi Community,

following situation:
there is a gateway between my LAN and the Internet, and now the programming part starts. :-)
I want to write a packetsniffer sitting on my Gateway. (shouldn't be the problem). The sniffer should have the opportunity to filter out disliked packets compared with a small rulebase. Wrong dest-address or whatever ...
Does anyone of you knows a way to drop these packets out of a given stream, so they dont reach their acutal destinations ?
I have read about BPF and the IPtables headers, but i havent found usefull documents :-(

edit: i forgot to say ... the programm should run in the userspace. // prefered language is C

Thanks in advance,
h.d.

Why re-invent the wheel?
IPTables does a pretty good job,
all you need is to make a set of rules?

And if you really want to program your own
filter, don't start out trying to understand
IPTables, rather grab a TCP/IP programming
primer ;) and start from scratch.

Just my 2 cents.


Cheers,
TInk

acutally my program should be a content-filter for http ... i don't think it is possible to set such rules with iptables.
i just want to run the sniffer, filtering the payload. This filter decide, whether there should be a full connection to the target host or not.
Maybe i can use iptables for dropping packets during the runtime ?!
If I would use just iptables doing this job, there is no dynamic effect. I dont have a real rulebase.

Now that sounds like a job for squid &
squid-guard or DanskGuardian :}

Cheers,
Tink

Maybe you should give an example of the payload (or classification) you want to filter for before I offer Snort as another alternative.

How does Squid or Snort drop these packets ...?
Actually i want to write my own filter... :-)

Squid(guard) stops the http traffic from
reaching the machine that requested the
unwanted contents ... it doesn't "physically"
drop the packet.

As for writing your own filter: go for it ;)

Cheers,
Tink

P.S.: Here a few Links google spat out ...

http://www.scit.wlv.ac.uk/~jphb/comms/sockets.html
http://www.linuxjournal.com/article.php?sid=2333
http://www.developerweb.net/sock-faq/

Thank you .. I will try it tonight