02-06-2011
C, LKM, netfilter, PF_PACKET and ARP.
Hello,
Everyone knows that with PF_PACKET sockets one can "sniff" a determinated frame from the network device, but just that, see the frame without altering its action on the receiving host. What i want is to "intercept" the incoming frame and pass it through some rules, and if it doesn't pass the rules, then DROP it without efecting its action on the host.
Let's say an ARP Request message, normally, the receiving host will create an entry on the ARP cache when it receives the ARP Request frame. If i use a PF_PACKET socket, i'll be able to see the packet, but not to intercept it, so however it passes my program rules or doesn't, its action will be the same, CREATE THE ARP ENTRY.
I know a little about netfilter and LKM programming, and i know that it does exactily what i want to do (intercept frames before it takes any action on the host), but from what i've seen, it just allows the programmer to handle IP level packets, so, what if i want to use netfilter to filter an ARP frame? Is it possible? And how is it done?
Thanks in advance.
9 More Discussions You Might Find Interesting
1. Programming
Hi everybody,
I have to write a module for matching in netfilter , extending the netfilter but I'm facing some problems can somebody guide me in that. I know that I need to write matching module working in kernel space and a program in userspace. I went through the HOWTO on netfilter-hacking but... (0 Replies)
Discussion started by: Trusted Penguin
0 Replies
2. Programming
Friends I'm facing a big problem trying to extend the netfilter. Somone please help me with your quick reply (any hint) as I've to meet a deadline.
My problem is that I've written a new netfilter target module and its corresponding userspace program for iptables to change the packet type of a... (0 Replies)
Discussion started by: Rakesh Ranjan
0 Replies
3. Programming
Hello friends i'm trying to extend iptables to include a target by which we can change the packet type field of a packet.
For this i created a kernel module and a userspace extension.
Now i face the problem that when i try to invoke iptable with the target i created i get an error message saying... (1 Reply)
Discussion started by: Rakesh Ranjan
1 Replies
4. IP Networking
hi,
i'm using tcpreplay to send a traffic trace to my wireless interface (the trace is been captured by the same interface). It seems as netfilter can't trace connections. Is it possible? (0 Replies)
Discussion started by: littleboyblu
0 Replies
5. Cybersecurity
Hi everyone, I would like to allow multi users to access P2P networks, so I wonder if there's a way to tracking these kind of protocols with netfilter, and also compatibility with nat, like the module conntrack_ftp seems to do with the FTP protocol.
Thanks guys. (0 Replies)
Discussion started by: nekkro-kvlt
0 Replies
6. Linux
HI,
Is the Netfilter and IPtables same?
Thanks & Regards
Arun (1 Reply)
Discussion started by: Arun.Kakarla
1 Replies
7. UNIX for Advanced & Expert Users
iam trying to built a firewall.so i have used netfilter for it.
in function main_hook sock_buff is returning null and in my log file continuously "sock buff null" is printed plse help to solve this problem..
(using print_string iam printing strings on current terminal (terminal we ping))
... (1 Reply)
Discussion started by: pavan6754
1 Replies
8. Cybersecurity
Hi all,
I would like to get some ideas and opinions on matter of libvirt netfilter application in KVM environment. I am looking for some easy way to control it with an API and possible experience with that and its performance in real life application.
Thanks for all ideas (0 Replies)
Discussion started by: smoofy
0 Replies
9. Cybersecurity
Hello,
on a PC with Debian 8 I try to use a Bash script with Netfilter rules so that only traffic goes in and out that is wanted. For that I set all 3 default policies to "drop". The machine uses DHCP to get its IP, gateway and DNS. And I never checked so I was quite surprised that my... (1 Reply)
Discussion started by: SInt
1 Replies
LEARN ABOUT SUSE
struct_ieee80211_rx_status
STRUCT
IEEE80211_RX_(9) The basic mac80211 driver inte STRUCT IEEE80211_RX_(9)
NAME
struct_ieee80211_rx_status - receive status
SYNOPSIS
struct ieee80211_rx_status {
u64 mactime;
enum ieee80211_band band;
int freq;
int signal;
int noise;
int antenna;
int rate_idx;
int flag;
};
MEMBERS
mactime
value in microseconds of the 64-bit Time Synchronization Function (TSF) timer when the first data symbol (MPDU) arrived at the
hardware.
band
the active band when this frame was received
freq
frequency the radio was tuned to when receiving this frame, in MHz
signal
signal strength when receiving this frame, either in dBm, in dB or unspecified depending on the hardware capabilities flags
IEEE80211_HW_SIGNAL_*
noise
noise when receiving this frame, in dBm.
antenna
antenna used
rate_idx
index of data rate into band's supported rates or MCS index if HT rates are use (RX_FLAG_HT)
flag
RX_FLAG_*
DESCRIPTION
The low-level driver should provide this information (the subset supported by hardware) to the 802.11 code with each received frame, in the
skb's control buffer (cb).
AUTHOR
Johannes Berg <johannes@sipsolutions.net>
Author.
COPYRIGHT
Kernel Hackers Manual 2.6. July 2010 STRUCT IEEE80211_RX_(9)