From: "John A. Sullivan III" <john.sullivan@nexusmgmt.com>
To: Mussie Gebregziabiher <mussieg@comcast.net>
Cc: netfilter@lists.netfilter.org
Subject: Re: tcpdump and iptables ..
Date: Sat, 06 Mar 2004 11:16:49 -0500 [thread overview]
Message-ID: <1078589808.2066.3.camel@localhost> (raw)
In-Reply-To: <FD1B6DC5FFF43C4888DCC155FE8C1FFE70CC74@7xch10ka.sevenspace.local>
On Sat, 2004-03-06 at 10:59, Mussie Gebregziabiher wrote:
> Dear All,
>
> When I run tcpdump I seem to be getting data after it is being processed by
> iptables. Can someone tell me where 'tcpdump' resides in the order of
> priority? Have the packets I'm seeing been subjected to 'PREROUTING' rules
> such as 'MANGLE' and 'NAT'?
<snip>
I'll relate my experiences trying to trace the interchange between
iptables and openswan but it is only from observation. If someone who
knows the code responds, please take their word for it over mine.
I believe you will see the packet on the inbound interface before it
hits the PREROUTING chain of the mangle table. You will see it on the
outbound interface after it has passed through POSTROUTING (I don't
recall off the top of my head if nat or mangle is last.
If there is a hand-off to another interface during packet processing,
you will see it again in tcpdump on the new interfaces again,
pre-PREROUTING and then post-POSTROUTING.
--
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
next prev parent reply other threads:[~2004-03-06 16:16 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <FD1B6DC5FFF43C4888DCC155FE8C1FFEBC0EB5@7xch10ka.sevenspace.local>
2004-03-06 15:59 ` tcpdump and iptables Mussie Gebregziabiher
2004-03-06 16:16 ` John A. Sullivan III [this message]
2004-03-06 18:12 ` Antony Stone
2004-03-06 18:46 ` Cedric Blancher
2004-03-06 23:44 ` Antony Stone
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1078589808.2066.3.camel@localhost \
--to=john.sullivan@nexusmgmt.com \
--cc=mussieg@comcast.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.