Creation of a custom netfilter/iptables target module

Creation of a custom netfilter/iptables target module

[Steve (Telsat Broadband)]

Hi All,

I'm seeking the wisdom of the netfilter gurus to get me going in the right
direction.

Currently, we have a gateway in which several iptables/ip6tables rules send
information to the LOG target which a custom perl script then reads to
perform some processing on the sender's MAC and IP.

What I'm wanting to do is relieve load on the system by cutting out the step
of logging to syslog and sending straight to the processing program either
via a socket or some other means.  I don't need to store any of the
information in the packet, only pass the MAC and IP (v4 or v6) to the
processing program.

Reading through the PDF by Jan
(http://inai.de/documents/Netfilter_Modules.pdf) and this site
(http://pudhumaijude.blogspot.com/2011/01/mini-howto-write-your-own-iptables
.html), I've been trying to make a modified version of the LOG target, but
the part I'm not quite understanding is which method in the module actually
performs the 'work'; the part of the module that actually receives the
package and performs the processing on it.

If anyone can give me some pointers, this would be very much appreciated.

Cheers.
Steve.

Re: Creation of a custom netfilter/iptables target module

[Pablo Neira Ayuso]

On Tue, Oct 08, 2013 at 10:35:10AM +1100, Steve (Telsat Broadband) wrote:
> Hi All,
> 
> I'm seeking the wisdom of the netfilter gurus to get me going in the right
> direction.
> 
> Currently, we have a gateway in which several iptables/ip6tables rules send
> information to the LOG target which a custom perl script then reads to
> perform some processing on the sender's MAC and IP.
> 
> What I'm wanting to do is relieve load on the system by cutting out the step
> of logging to syslog and sending straight to the processing program either
> via a socket or some other means.  I don't need to store any of the
> information in the packet, only pass the MAC and IP (v4 or v6) to the
> processing program.

Did you consider ulogd2?

Regards.