Filtering packets with Packet MMAP?

Question

I'm using packet_mmap to capture all packets in the system, but there doesn't seem to be any way to interfere with the rest of the OS getting them as well. I want to be able to have exclusive control over packets coming into userland and decide whether they get to go onto other applications in the system or if they get dropped, so I can filter the packets based on criteria.

Is there any method of doing this? I can't seem to find any documentation on this particular subject. I guess what I want is to be able to remove all incoming packets from the IP stack so no other program gets them, and then be able to reinsert packets on a packet-by-packet basis.

Answer 1

You can't do what you want with PACKET sockets - they're not designed for that purpose.

What you need to use instead is libnetfilter_queue, together with an iptables rule that directs all incoming packets to your queue.