question

question

[Marcin Giedz]

Hi,


I'd like to ask if it possible to change "data" field (its content) in TCP 
packet on fly? I don't need to change data's lenght but only change few bytes 
in it.

Example:
0000  ff ff ff ff ff ff 00 11 25 31 ad e0 08 00 45 00   ........%1....E.
0010  00 c1 0a b1 00 00 80 11 82 0f ac 13 01 59 ff ff   .............Y..
0020  ff ff 04 2d 01 db 00 ad 60 78 ad a7 5b de 9f 26   ...-....`x..[..&
0030  ec 98 2d 26 ec 18 2d 26 ec 18 2d 26 ec 18 2d 26   ..-&..-&..-&..-&
0040  ec 18 2d 26 ec 18 2d 26 ec 18 2d 26 ec 18 2d 26   ..-&..-&..-&..-&

First line contains MAC address 00:11:25:31:ad:e0 - I need to change it to 
other value. 

Is it possible at all?

Marcin

Re: question

[Ruprecht Helms]

Hi Marcin,
> 
> I'd like to ask if it possible to change "data" field (its content) in TCP 
> packet on fly? I don't need to change data's lenght but only change few bytes 
> in it.
> 
> Example:
> 0000  ff ff ff ff ff ff 00 11 25 31 ad e0 08 00 45 00   ........%1....E.

much you can do with tcpdump.

Regards,
Ruprecht

------------------------------------------------------------------------------------------
Ruprecht Helms IT-Service & Softwareentwicklung

Tel./Fax  +49[0]7621 16 99 16
Web:       htp://www.rheyn.de

Re: question

[Marcin Giedz]

Dnia czwartek, 27 pa¼dziernika 2005 10:18, Ruprecht Helms napisa³:
> Hi Marcin,
>
> > I'd like to ask if it possible to change "data" field (its content) in
> > TCP packet on fly? I don't need to change data's lenght but only change
> > few bytes in it.
> >
> > Example:
> > 0000  ff ff ff ff ff ff 00 11 25 31 ad e0 08 00 45 00   ........%1....E.
>
> much you can do with tcpdump.

I don't get it :(
How with tcpdump as tcpdump is only dump traffic tool - as I know it can't 
change anything or I'm wrong?

Marcin

>
> Regards,
> Ruprecht
>
> ---------------------------------------------------------------------------
>--------------- Ruprecht Helms IT-Service & Softwareentwicklung
>
> Tel./Fax  +49[0]7621 16 99 16
> Web:       htp://www.rheyn.de

Re: question

[Ruprecht Helms]

Marcin Giedz wrote:

> 
> I don't get it :(
> How with tcpdump as tcpdump is only dump traffic tool - as I know it can't 
> change anything or I'm wrong?

You are right. As I know it only dump.
What you need is a hexeditor or you are looking for a tool that do 
hexediting in the fly.

But that is offtopic in this list.

Regards,
Ruprecht

Re: question

[Sorin Panca]

Ruprecht Helms wrote:
> Marcin Giedz wrote:
> 
>>
>> I don't get it :(
>> How with tcpdump as tcpdump is only dump traffic tool - as I know it
>> can't change anything or I'm wrong?
> 
> 
> You are right. As I know it only dump.
> What you need is a hexeditor or you are looking for a tool that do
> hexediting in the fly.
> 
> But that is offtopic in this list.
I think he needs a packet mangling tool: he's not offtopic.

Re: question

[Marcin Giedz]

Dnia czwartek, 27 pa¼dziernika 2005 11:09, Ruprecht Helms napisa³:
> Marcin Giedz wrote:
> > I don't get it :(
> > How with tcpdump as tcpdump is only dump traffic tool - as I know it
> > can't change anything or I'm wrong?
>
> You are right. As I know it only dump.
> What you need is a hexeditor or you are looking for a tool that do
> hexediting in the fly.

Absolutely! 

>
> But that is offtopic in this list.

But I really don't know where to start? Perhaps some did it earlier.

Marcin

>
> Regards,
> Ruprecht

Re: question

[Oskar Andreasson]

[-- Attachment #1: Type: text/plain, Size: 1691 bytes --]

Hi Marcin, 

iptables and netfilter will not do the job, unless you are willing to
sacrifice stability and security. The problem is that the strings that
netfilter will see are broken down into smaller pieces. So the string
"iptables and netfilter" might actually be transmitted as "iptables and"
and then "netfilter" in a separate packet. On top of this, people might
try to intentionally break your filters by fragmenting the above string
into "i", "p", "t", ... etc packets. 

The good thing to do in this case, is to wait until the TCP stream has
reached the application layer and has been reassembled properly. Hence,
you will want to either write your own proxy, or to use someone elses
proxy. 

If you want to use it, I just uploaded a tunnel/proxy program to
http://www.frozentux.net/stunnel.tgz. This is an unfinished program I
started on a couple of years ago. It is written in C. It is horribly
coded and pretty much sucks, but it has no memory leaks and might serve
as a starting point.

Have a nice day;).


On Thu, 2005-10-27 at 11:40 +0200, Marcin Giedz wrote:
> Dnia czwartek, 27 października 2005 11:09, Ruprecht Helms napisał:
> > Marcin Giedz wrote:
> > > I don't get it :(
> > > How with tcpdump as tcpdump is only dump traffic tool - as I know it
> > > can't change anything or I'm wrong?
> >
> > You are right. As I know it only dump.
> > What you need is a hexeditor or you are looking for a tool that do
> > hexediting in the fly.
> 
> Absolutely! 
> 
> >
> > But that is offtopic in this list.
> 
> But I really don't know where to start? Perhaps some did it earlier.
> 
> Marcin
> 
> >
> > Regards,
> > Ruprecht
> 

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: question

[Marcin Giedz]

Dnia czwartek, 27 pa¼dziernika 2005 12:04, Oskar Andreasson napisa³:
> Hi Marcin,
>
> iptables and netfilter will not do the job, unless you are willing to
> sacrifice stability and security. The problem is that the strings that
> netfilter will see are broken down into smaller pieces. So the string
> "iptables and netfilter" might actually be transmitted as "iptables and"
> and then "netfilter" in a separate packet. On top of this, people might
> try to intentionally break your filters by fragmenting the above string
> into "i", "p", "t", ... etc packets.
>
> The good thing to do in this case, is to wait until the TCP stream has
> reached the application layer and has been reassembled properly. Hence,
> you will want to either write your own proxy, or to use someone elses
> proxy.
>
> If you want to use it, I just uploaded a tunnel/proxy program to
> http://www.frozentux.net/stunnel.tgz. This is an unfinished program I
> started on a couple of years ago. It is written in C. It is horribly
> coded and pretty much sucks, but it has no memory leaks and might serve
> as a starting point.

Great!!! Really thanks but I just can't reach your program - above address 
doesn't work :( Could you please do something or send the program on my 
private mail.

Thanks once again,
Marcin

>
> Have a nice day;).
>
> On Thu, 2005-10-27 at 11:40 +0200, Marcin Giedz wrote:
> > Dnia czwartek, 27 pa¼dziernika 2005 11:09, Ruprecht Helms napisa³:
> > > Marcin Giedz wrote:
> > > > I don't get it :(
> > > > How with tcpdump as tcpdump is only dump traffic tool - as I know it
> > > > can't change anything or I'm wrong?
> > >
> > > You are right. As I know it only dump.
> > > What you need is a hexeditor or you are looking for a tool that do
> > > hexediting in the fly.
> >
> > Absolutely!
> >
> > > But that is offtopic in this list.
> >
> > But I really don't know where to start? Perhaps some did it earlier.
> >
> > Marcin
> >
> > > Regards,
> > > Ruprecht

Re: question

[Oskar Andreasson]

[-- Attachment #1: Type: text/plain, Size: 2470 bytes --]

On Thu, 2005-10-27 at 12:25 +0200, Marcin Giedz wrote:
> Dnia czwartek, 27 października 2005 12:04, Oskar Andreasson napisał:
> > Hi Marcin,
> >
> > iptables and netfilter will not do the job, unless you are willing to
> > sacrifice stability and security. The problem is that the strings that
> > netfilter will see are broken down into smaller pieces. So the string
> > "iptables and netfilter" might actually be transmitted as "iptables and"
> > and then "netfilter" in a separate packet. On top of this, people might
> > try to intentionally break your filters by fragmenting the above string
> > into "i", "p", "t", ... etc packets.
> >
> > The good thing to do in this case, is to wait until the TCP stream has
> > reached the application layer and has been reassembled properly. Hence,
> > you will want to either write your own proxy, or to use someone elses
> > proxy.
> >
> > If you want to use it, I just uploaded a tunnel/proxy program to
> > http://www.frozentux.net/stunnel.tgz. This is an unfinished program I
> > started on a couple of years ago. It is written in C. It is horribly
> > coded and pretty much sucks, but it has no memory leaks and might serve
> > as a starting point.
> 
> Great!!! Really thanks but I just can't reach your program - above address 
> doesn't work :( Could you please do something or send the program on my 
> private mail.
> 

Sorry about that, I got an urgent task on my desk and forgot to upload
the file:). It's uploaded now. Do note that this is just a very ugly
framework really, you need to do all the parsing etc on your own, and I
have a bad habit of not commenting work in progress projects... =)

> Thanks once again,
> Marcin
> 
> >
> > Have a nice day;).
> >
> > On Thu, 2005-10-27 at 11:40 +0200, Marcin Giedz wrote:
> > > Dnia czwartek, 27 października 2005 11:09, Ruprecht Helms napisał:
> > > > Marcin Giedz wrote:
> > > > > I don't get it :(
> > > > > How with tcpdump as tcpdump is only dump traffic tool - as I know it
> > > > > can't change anything or I'm wrong?
> > > >
> > > > You are right. As I know it only dump.
> > > > What you need is a hexeditor or you are looking for a tool that do
> > > > hexediting in the fly.
> > >
> > > Absolutely!
> > >
> > > > But that is offtopic in this list.
> > >
> > > But I really don't know where to start? Perhaps some did it earlier.
> > >
> > > Marcin
> > >
> > > > Regards,
> > > > Ruprecht

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: question

[Marcin Giedz]

> Sorry about that, I got an urgent task on my desk and forgot to upload
> the file:). It's uploaded now. Do note that this is just a very ugly
> framework really, you need to do all the parsing etc on your own, and I
> have a bad habit of not commenting work in progress projects... =)
	
Hmm..  still have the same problem - sorry :( I tried http://www.frozentux.net 
as well but it seems like some problems with PHP script :(

BR,
Marcin

Re: question

[Oskar Andreasson]

[-- Attachment #1: Type: text/plain, Size: 927 bytes --]

Shit happens, but now it works again. the admin of my site decided to
switch the dns records over to a temporary site while they are upgrading
the machine. my local dns server cached the old records while you seem
to have gotten to the new servers, and i didn't see it. 

To make a long story short, it's fixed. Same place as previously
mentioned... 3rd times the charm *crossing fingers* =)

On Thu, 2005-10-27 at 13:18 +0200, Marcin Giedz wrote:
> > Sorry about that, I got an urgent task on my desk and forgot to upload
> > the file:). It's uploaded now. Do note that this is just a very ugly
> > framework really, you need to do all the parsing etc on your own, and I
> > have a bad habit of not commenting work in progress projects... =)
> 	
> Hmm..  still have the same problem - sorry :( I tried http://www.frozentux.net 
> as well but it seems like some problems with PHP script :(
> 
> BR,
> Marcin

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Question

[Karim Reda Fakhir]

How can i do SNAT and DNAT in same time with iptables , i try to
change Ip src and Ip dest .


                  Best Regards.

Re: Question

[Jan Engelhardt]

On Monday 2008-04-28 11:01, Karim Reda Fakhir wrote:

>How can i do SNAT and DNAT in same time with iptables , i try to
>change Ip src and Ip dest .

-t nat -A PREROUTING -j DNAT ...
-t nat -A POSTROUTING -j SNAT ...
no?

Re: Question

[Diego Lacerda]

Yeah,

It's possible, netfilter will change the packet as it passes through
the chains (in the NAT table).

Regards,
Diego Lacerda.

On Mon, Apr 28, 2008 at 7:11 AM, Jan Engelhardt <jengelh@computergmbh.de> wrote:
>
>
> On Monday 2008-04-28 11:01, Karim Reda Fakhir wrote:
>
> >How can i do SNAT and DNAT in same time with iptables , i try to
> >change Ip src and Ip dest .
>
> -t nat -A PREROUTING -j DNAT ...
> -t nat -A POSTROUTING -j SNAT ...
> no?
>
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

question

[Fabio S. Silva]

Hi all, i trying to find tools to test my firewall, i need to make
some test like "Sustained TCP Connections" but i dont know tools to do
it.. and... i need some tools to simulate an ddos to my firewall to
see if its droping packets, etc..
anybody can help me ??

best regards..

Fabio S. Silva

RE: question

[Sietse van Zanen]

Usually you would test your firewall with the applications you need to use through it. That would be the only realistic test application wise.
 
For testing sustained tcp connections you can use a tool tike TTCP, which can open the connection and test throughput of your firewall.
http://www.pcausa.com/Utilities/pcattcp.htm
 
Foor DDOS simulations, you would need multiple pc's on your network and a simulation tool:
http://www.ssfnet.org/javadoc/SSF/App/DDoS/package-summary.html
 
-Sietse

________________________________

From: netfilter-bounces@lists.netfilter.org on behalf of Fabio S. Silva
Sent: Wed 21-Jun-06 14:14
To: netfilter@lists.netfilter.org
Subject: question



Hi all, i trying to find tools to test my firewall, i need to make
some test like "Sustained TCP Connections" but i dont know tools to do
it.. and... i need some tools to simulate an ddos to my firewall to
see if its droping packets, etc..
anybody can help me ??

best regards..

Fabio S. Silva

question

[emiliano]

[-- Attachment #1: Type: text/plain, Size: 502 bytes --]

Hi, could you give me some help about the question below?

 

I have  a Total Control with a private pool of IPs. I’m using IPTables with
NAT and HT23 modules. My trouble is that while I get a perfect video stream,
I’m unable to transmitt/receive audio (through the instant Messenger from
Microsoft, MSN Messenger ). 

 

Some sugestión about? I really will be greateful with you if you can give me
some idea …

 

Thanks!! 

 

Best regards

 

Emiliano Barbat

Argentina


[-- Attachment #2: Type: text/html, Size: 2684 bytes --]

RE: question

[George Vieira]

Look in the archives yet? Done a google search?

Use the H323 patch from patch-o-matic.

Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au

Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au

-----Original Message-----
From: Sander Sneekes [mailto:sander@dmdsecure.com]
Sent: Friday, June 13, 2003 6:42 AM
To: Netfilter
Subject: question


Hi all,

Small qeustion anybody have any clue howto get 
microsoft netmeeting to work from behind an iptables
firewall?

I'm able to accept a conf. en send text but no video/audio



cheers
Sander

question

[Sander Sneekes]

Hi all,

Small qeustion anybody have any clue howto get 
microsoft netmeeting to work from behind an iptables
firewall?

I'm able to accept a conf. en send text but no video/audio



cheers
Sander

Question

[Krish Ahya]

[-- Attachment #1: Type: text/plain, Size: 589 bytes --]

Hi all,

I was just wondering, is Netfilter as good as Cisco's PIX and Checkpoint's Firewall-1, if not better?

Also I'm wondering say if I have a dmz and allow people to come into a server on port 80, will netfilter inspect the packet on all 7 layers of the OSI model and make sure that it is actually a http packet and following the rules and protocol specifications of http? Sorta like checkpoints INSPECT module.

Thanks.

- Krish
~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
I have not failed 10,000 times, I have sucessfully found 10,000 ways that won't work." -- Thomas A. Edison

[-- Attachment #2: Type: text/html, Size: 1318 bytes --]

Re: Question

[Antony Stone]

On Friday 21 June 2002 6:33 pm, Krish Ahya wrote:

> Hi all,
>
> I was just wondering, is Netfilter as good as Cisco's PIX and Checkpoint's
> Firewall-1, if not better?

Yes.

> Also I'm wondering say if I have a dmz and allow people to come into a
> server on port 80, will netfilter inspect the packet on all 7 layers of the
> OSI model and make sure that it is actually a http packet and following the
> rules and protocol specifications of http?

No.


At least one of the above answers is merely my personal opinion.

 

Antony.

RE: Question

[James Mello]

> > Also I'm wondering say if I have a dmz and allow people to 
> come into a 
> > server on port 80, will netfilter inspect the packet on all 
> 7 layers 
> > of the OSI model and make sure that it is actually a http 
> packet and 
> > following the rules and protocol specifications of http?

No, but there are experimental modules that will allow you to enforce
your own rules. I've heard of some IDS or attack detection capabilities
being done through IP tables.

	-- Cheers
	-- James

Re: Question

[Antony Stone]

On Friday 21 June 2002 7:31 pm, James Mello wrote:

> > Also I'm wondering say if I have a dmz and allow people to come into a
> > server on port 80, will netfilter inspect the packet on all 7 layers
> > of the OSI model and make sure that it is actually a http packet and
> > following the rules and protocol specifications of http?
>
> No, but there are experimental modules that will allow you to enforce
> your own rules. I've heard of some IDS or attack detection capabilities
> being done through IP tables.

What sort of modules ?   I *hope* you don't mean the 'string' match ?

I'm not aware of anything based on IPtables which makes an effective (OSI 
layer 7) IDS - it's just not designed for it, being a packet filter.....

 

Antony.

RE: Question

[James Mello]

> > No, but there are experimental modules that will allow you 
> to enforce 
> > your own rules. I've heard of some IDS or attack detection 
> > capabilities being done through IP tables.
> 
> What sort of modules ?   I *hope* you don't mean the 'string' match ?

Yeah, I actually do mean the 'string' match :) I've got some friends who
used this to do some filtering on content on their own internet exposed
boxes to prevent stupid Nimda worm and other attacks from being
perpetrated. They *did* say it was slow, but overall it's been a pretty
effective solution for them. Note I *never* did say that you can do all
sorts of Layer 7 evaluation (or validation) like the guy said. I just
suggested this as an option to do some layer 7 filtering and content
checking...

	-- Cheers
	-- James

Re: Question

[Antony Stone]

On Saturday 22 June 2002 12:16 am, James Mello wrote:

> > > No, but there are experimental modules that will allow you to enforce
> > > your own rules. I've heard of some IDS or attack detection
> > > capabilities being done through IP tables.
> >
> > What sort of modules ?   I *hope* you don't mean the 'string' match ?
>
> Yeah, I actually do mean the 'string' match :) I've got some friends who
> used this to do some filtering on content on their own internet exposed
> boxes to prevent stupid Nimda worm and other attacks from being
> perpetrated.

Hmmm.   Okay, I'll agree you can do a certain amount of string matching, with 
a certain degree of reliability, wiht this module, but I think for an IDS I'd 
rather go for snort / hogwash.

 

Antony.

Re: Question

[Jack Bowling]

** Reply to message from Antony Stone <Antony@Soft-Solutions.co.uk> on Sat, 22 Jun 2002 00:12:28 +0100


> On Friday 21 June 2002 7:31 pm, James Mello wrote:
> 
> > > Also I'm wondering say if I have a dmz and allow people to come into a
> > > server on port 80, will netfilter inspect the packet on all 7 layers
> > > of the OSI model and make sure that it is actually a http packet and
> > > following the rules and protocol specifications of http?
> >
> > No, but there are experimental modules that will allow you to enforce
> > your own rules. I've heard of some IDS or attack detection capabilities
> > being done through IP tables.
> 
> What sort of modules ?   I *hope* you don't mean the 'string' match ?
> 
> I'm not aware of anything based on IPtables which makes an effective (OSI 
> layer 7) IDS - it's just not designed for it, being a packet filter.....

There is the psd module. Check it out.

jb

-- 
Jack Bowling
mailto: jbinpg@shaw.ca

Re: Question

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 507 bytes --]

* Jack Bowling (jbinpg@shaw.ca) wrote:
> ** Reply to message from Antony Stone <Antony@Soft-Solutions.co.uk> on Sat, 22 Jun 2002 00:12:28 +0100
> > What sort of modules ?   I *hope* you don't mean the 'string' match ?
> > 
> > I'm not aware of anything based on IPtables which makes an effective (OSI 
> > layer 7) IDS - it's just not designed for it, being a packet filter.....
> 
> There is the psd module. Check it out.

There's also my recent module, just to throw it in there. :)

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]

Re: Question

[Ramin Alidousti]

On Sat, Jun 22, 2002 at 11:25:48AM -0400, Stephen Frost wrote:

> > > I'm not aware of anything based on IPtables which makes an effective (OSI 
> > > layer 7) IDS - it's just not designed for it, being a packet filter.....
> > 
> > There is the psd module. Check it out.
> 
> There's also my recent module, just to throw it in there. :)

Which IMHO is much _more_ powerful :-)

Ramin

> 	Stephen

Re: Question

[Nick Drage]

On Fri, Jun 21, 2002 at 12:33:15PM -0500, Krish Ahya wrote:
> Hi all,
> 
> I was just wondering, is Netfilter as good as Cisco's PIX and Checkpoint's
> Firewall-1, if not better?

Depends what you mean by "good", which is a little too general to rate
something as complex as a firewall.  In relation to Firewall-1 it is
cheaper, it is possibly as efficient and as secure ( with the right
configuration ), configuration is more difficult IMHO... and all that
depends on the situation you're using it and the skill of the
administrators.

At the least it's free to try... :)

-- 
FunkyJesus System Administration Team

RE: Question

[Rowan Reid]

>>At the least it's free to try... :)

Does anyone know where to find documentation for Firewall-1 I decided to
try it once but couldn't find any documentation to save my life.

Re: Question

[Sascha Reissner]

From: Krish Ahya

> I was just wondering, is Netfilter as good as Cisco's PIX and Checkpoint's
Firewall-1, if not better?

its hard to compare apples with pears.. one is a firewalling system..
netfilter is more or less a packet filter....

> Also I'm wondering say if I have a dmz and allow people to come into a
server on port 80, will netfilter inspect the packet on all
> 7 layers of the OSI model and make sure that it is actually a http packet
and following the rules and protocol specifications of
> http? Sorta like checkpoints INSPECT module.

as netfilter is "only" a packet filter (with some additional modules to
provide more functions) you will stick with stuff like string match and all
modules you would like to provide the netfilter community (if you code them
yourself)