How to extract payload from packet in queue of iptables

Question

I am using libnetfilter_queue library. But i couldn't figure out a way to extract payload in the call back function. I am bit new. A detailed help will be highly appreciated! Actually i further wish to extract http header from the payload.

Answer 1

Once you have gotten till callback, get the file descriptor associated with the nfqueue handler using the following api.

int nfq_fd (struct nfq_handle *h);

Then call a standard recv() which takes a descriptor to read from, a buffer in which it fills the data and the length of buffer.

if(recv(fd, buf, sizeof(buf), 0) >= 0)
        printf("pkt received in buf\n");

Now buf contains the entire packet. I don't think there is an explicit api available to parse http. You can read the spec of http standard and skip bytes up to the fields you are looking for.

libnetfilerqueue