Re: H323 and Traffic Control

[Cedric Blancher <blancher@cartel-securite.fr>]

Le ven 25/10/2002 à 13:36, yves.metivier a écrit :
> I was expecting that h323 netfilter module should mark all 
> h323 traffic, including RTP and RTCP UDP packets, but it seems 
> that it only marks packets from known ports (those explicitely 
> declared in iptables), and not UDP related packets.

H323 module's goal is to declare what kind of packets are expected by
H323 flows to have them given the RELATED state. And that's all.

If you want to mark thoses packets, then you'll have to do it yourself.
The main Netfilter distribution does not provide matches to do it well,
but you'll find helper pacth in submitted section of iptables 1.2.7a
patch-o-matic. This patch creates a new match called helper that allows
you to spot packets that are handled by a specific conntrack module. I
didn't tried what you want to do, but I think this can do the trick :

	iptables -t mangle -A PREROUTING -m helper --helper h323 \
		-j MARK --set-mark 0x01
 
> Is my analyse right?

Nope ;)
Conntrack is something particular in Netfilter. It gives state to
packets, and then, it's up to you to use this state value to achieve
what you want to do.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE