raw packet capture based on offset

raw packet capture based on offset

[colorchip]

Hi,

I want to capture raw packets based on the ethernet source (mac) and a 16 bit identifier following the ethtype. I am unable to find a generic filter which gives me a freedom to filter the packet based on any bit length and offset from the beginning of the packet. Can anyone help?

-nks

Re: raw packet capture based on offset

[Alexey Toptygin]

On Thu, 22 Sep 2005 colorchip@sify.com wrote:

> I want to capture raw packets based on the ethernet source (mac) and a 
> 16 bit identifier following the ethtype. I am unable to find a generic 
> filter which gives me a freedom to filter the packet based on any bit 
> length and offset from the beginning of the packet. Can anyone help?

I think you want the u32 match from POM-ng.

 			Alexey

PPTP/IPSec multiple clients behind iptables NAT

[Salim]

I am using iptables 1.3.3

I had some problems with multiple clients behind NAT(a simple MASQUERADE
rule is set) connecting to the same VPN server. ONly one client can connect
at a time.
I have enables the CONFIG_IP_NF_PPTP and CONFIG_IP_NF_CT_PROTO_GRE options
in kernel.

I have read a few posts about this issue in the list from as early as in
2003. But could not find a conclusion.

Could you guys please clarify? Is this scenario supported by iptables? If
not, is there a way to get around this issue?

thanks
Salim

RE: raw packet capture based on offset

[Harrison, Bruce (CXO)]

Do you want to do packet capture or packet filtering?  For packet
capture, have a look at tcpdump.  I know it can capture based on source
and/or destination Ethernet address.  Not sure if it can capture on the
other field that you are looking for.

Take care,

Bruce...

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of
colorchip@sify.com
Sent: Wednesday, September 21, 2005 9:29 PM
To: netfilter@lists.netfilter.org
Subject: raw packet capture based on offset

Hi,

I want to capture raw packets based on the ethernet source (mac) and a
16 bit identifier following the ethtype. I am unable to find a generic
filter which gives me a freedom to filter the packet based on any bit
length and offset from the beginning of the packet. Can anyone help?

-nks