I want to deny a particular malicious UDP packet. I can readily identify this packet from the rest by looking at the data section, where data offset 2 is 0xaa, data[5] is 0xbb, etc. Are there any tools or code samples that can do this?

Basically, instead of seeing the packet in the following tcpdump, I want to block it. I started to write a proxy but realized I would need to keep sessions and that's a nightmare. Is there an easier way to do this? The firewalls I've seen only block based on port, not on data payload.


tcpdump -i eth1 udp[2:1] = 0xaa and udp[5:2] = 0xbbcc

Hey, from my understanding of how TCPDump and IPTables work, below is the path.

Internet > NIC > TCPDump > IPTables > Local System

Thus, blocking packets with IPTables will not stop them from showing in TCPDump.

Hope this helps!

Correct, you will need to block the UDP traffic before it hits the local NIC, preferably via the nearest router or some IPS, if available.