Launch script when packet is received

Launch script when packet is received

[octane indice]

Hello

Is there any way to do something like this:

iptables -A INPUT <packet> -j ACTION --script /sbin/myscript.sh

And better, with myscript.sh called with arguments like IP src or dest or
protocol or type of packet?
 
thanks

Tout doux les dépenses santé. Votre Assurance Santé à partir de 18€ par mois : http://www.alinto.com/pub/

Re: Launch script when packet is received

[Amin Azez]

* octane indice wrote, On 05/03/07 23:03:
> Hello
> 
> Is there any way to do something like this:
> 
> iptables -A INPUT <packet> -j ACTION --script /sbin/myscript.sh
> 
> And better, with myscript.sh called with arguments like IP src or dest or
> protocol or type of packet?

err.... crikey!
The short answer is: Thankfully not.

The longer answer is yeee-ee-e-es.

You can either use -j LOG and fiddle with your syslog.conf file so that
the logged messages that match are written to a named pipe, and you have
a dispatch daemon that listens on the pipe (you can write this in bash)
and calls your scripts.

Or you could use the depracated ULOG v1 target which receives packets
over netlink and hack the ulog daemon to do your bidding launching scripts.

Or you could use the QUEUE target to queue whole packets to user space
and then use a perl NF QUEUE hander to do your work for you.

I'm sure you have an interesting reason for wanting to do it.

Just don't ask for shell script matches where the exit code of the shell
script is taken as the match result. Although you could probably do this
 using the NF QUEUE method you would also have bad dreams. Or something.

Sam

Re: Launch script when packet is received

[Maik Hentsche]

Zitat von Amin Azez <azez@ufomechanic.net>:

> Or you could use the depracated ULOG v1 target which receives packets
> over netlink and hack the ulog daemon to do your bidding launching scripts.

Or you can use specter for the same deprecated ULOG target because  
this daemon already has a "call a script" module (among other  
improvements over ulogd). Unfortunatelly I do not know of any efforts  
to make specter use libnfnetlink.

so long
Maik