Re: Reg:Conntrack-tool for packet dropping?

[Ed W <lists@wildgooses.com>]

On 04/10/2011 15:09, Manikandan R wrote:
>  Hi,
>     I am developing application monitoring tool. When I gothru
> http://netfilter.org/, I come to know about the conntrack-tool which
> can be used for monitoring new connection.
>     I used "conntrackd"(conntrack deamon) for monitoring the packets.
> Using nfct_callback_register2() am able to handle new packets also,
> but I need to drop this packet if its related to particular
> pid/process. Is there is any way/api to drop packets?
>

Conntrack doesn't quite track all packets - see my previous questions
about this...

I think also if you need to examine all packets and decide their fate
ahead of allowing them through then you need to look at userspace queue
stuff?

Note you can setup some extremely clever filtering using iptables. That
has the ability to filter based on local user id, possibly process id
and also your app can set firewall marks on each packet that can be
easily filtered on later?

Good luck

Ed E