iptables and libpcap

Question

i have rule set up to drop udp/tcp packets with matching strings. however, my program which captures packet using libpcap, is still able to see this packet.

Why is this/, what should be the iptable rules to drop packets before it is seen by libpcap?

Is there anyway,perhaps other than iptables rules, to drop this packet before it is seen by libpcap/tcpdump?

Answer 1

Yes, libpcap sees all the packets.. They are being captured before being processed by the netfilter.

Answer 2

Did you try to change the priority of the netfilter hook you use? if you try hooking with the highest priority for incoming packets, it will get the packet before the packet socket kernel code, which is the way libpcap uses to capture packets.

* I assume you are using linux *

EDIT: Libpcap uses different ways to capture packets - according to the OS. on linux it uses packet socket which is implemented in kernel code using the netfilter framework.

Answer 3

Theres no way for libpcap to see the packets before netfilter, netfilter is a kernel module, and processes all packets before they hit user mode, it can even see the packets before the kernel sees it. Could you explain further explain ? Its possible that libpcap is also setting hooks on netfilter that overwrite the one in iptables. The real issue is that looking and what hooks are set on netfilter is far from trivial, and can only be done in kernel mode. Investigate how libpcap gets the packets.