can tcp stream reassembly be done in netfilter

can tcp stream reassembly be done in netfilter

[zhengchuanbo]

	Can netfilter do the tcp stream reassembly? I mean something like what snort
do in the stream process. I wish this could be done in the kernel.
	
regards,
chuanbo zheng
zhengchuanbo@sina.com
	
	
	

Re: can tcp stream reassembly be done in netfilter

[Oskar Andreasson]

On Tue, 26 Aug 2003, zhengchuanbo wrote:

> 	Can netfilter do the tcp stream reassembly? I mean something like
> what snort do in the stream process. I wish this could be done in the
> kernel.

No, netfilter is a packet filter. It works on a per packet basis, below
the transport layer. Actually it does do some work on the transport layer,
but not much, and definitely not a lot of work on the application layers.

All of this comes down to one thing, netfilter simply doesnt care about
streams. That's when you should use snort or proxy solutions of one sort
or another.

>
> regards,
> chuanbo zheng
> zhengchuanbo@sina.com
>
>
>
>
>
>
>
>

----
Oskar Andreasson
http://www.frozentux.net
http://iptables-tutorial.frozentux.net
http://ipsysctl-tutorial.frozentux.net
mailto:blueflux@koffein.net

Re: can tcp stream reassembly be done in netfilter

[Evrim ULU]

Oskar Andreasson wrote:

>On Tue, 26 Aug 2003, zhengchuanbo wrote:
>  
>
>>	Can netfilter do the tcp stream reassembly? I mean something like
>>what snort do in the stream process. I wish this could be done in the
>>kernel.
>>    
>>
>
>No, netfilter is a packet filter. It works on a per packet basis, below
>
>streams. That's when you should use snort or proxy solutions of one sort
>or another.
>
>  
>
Hi,

I am considering to try this one. Snort is a crap on behalf of my 
examinations about tcpreassambly code. (see state evasion bug) Linux 
kernel includes tcp reassembly thing and one can use it to glue data for 
signature check. The only reason for this is, *why don't we have a 
kernel based signature ids?*. Anybody interested in discussion may mail 
me, don't want to abuse ppl here.

Evrim.

New netfilter module.

[Christian Hentschel]

Please , 
     I\'m trying to write a new module and i need some help ;). 
     What i need to do is a module for dnat UDP packets but always to the same IP if they came from a determinated IP.. i don\'t know if i\'m clear.. but the idea is to use it for UDP RAS msgs in an h323 session... haveing a proxy that balance all those msgs to some RAS servers.
     well i thougth to write an nat-helper module.. but i don;t know if it\'s right.. may be the right thing is to write a new target module?.. 
    Please can someone give me a hand with this? 

Thanks a lot in advance. 
Christian.

Re: can tcp stream reassembly be done in netfilter

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1217 bytes --]

On Wed, Aug 27, 2003 at 10:35:10AM +0200, Oskar Andreasson wrote:
> On Tue, 26 Aug 2003, zhengchuanbo wrote:
> 
> > 	Can netfilter do the tcp stream reassembly? I mean something like
> > what snort do in the stream process. I wish this could be done in the
> > kernel.
> 
> No, netfilter is a packet filter. It works on a per packet basis, below
> the transport layer. Actually it does do some work on the transport layer,
> but not much, and definitely not a lot of work on the application layers.
> 
> All of this comes down to one thing, netfilter simply doesnt care about
> streams. That's when you should use snort or proxy solutions of one sort
> or another.

Thanks for this excellent reply.  

I have to add that there is a project for linux kernel stream reassembly
and pattern-matching:  libqsearch.  Try google :)

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: can tcp stream reassembly be done in netfilter

[Oskar Andreasson]

On Sat, 30 Aug 2003, Harald Welte wrote:

>
> I have to add that there is a project for linux kernel stream reassembly
> and pattern-matching:  libqsearch.  Try google :)
>

Hmmm, but does this hock into netfilter in any way, or does it have any
kind of interface for tcp/ip or socket filtering etcetera? Curiosity you
know.

Sidenote, is the netfilter.org lists extremely dead, or is it just me not
getting any mails...?


----
Oskar Andreasson
http://www.frozentux.net
http://iptables-tutorial.frozentux.net
http://ipsysctl-tutorial.frozentux.net
mailto:blueflux@koffein.net