libipq and destination IP address

libipq and destination IP address

[Khoa Nguyen]

Hi,

I am writing a small libipq program to extract packet info. I "queued"
all packets in the OUTPUT chain. It looks like the packet has the same
source and destination packet ( = host interface address). Why is
that? Is there a way in libipq to extract the REAL destination
address?

Thanks,
Khoa

Re: libipq and destination IP address

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 818 bytes --]

Hi,

Le mardi 16 octobre 2007 à 10:44 -0400, Khoa Nguyen a écrit :
> Hi,
> 
> I am writing a small libipq program to extract packet info. I "queued"
> all packets in the OUTPUT chain. It looks like the packet has the same
> source and destination packet ( = host interface address). Why is
> that? Is there a way in libipq to extract the REAL destination
> address?

First of all: switch to libnetfilter_queue

For your question, libipq sends to userspace the whole content of the
packet. Thus there is no potential problem of address rewriting. You can
have a look at the following code extract from NuFW:
http://docs.nufw.org/doxygen/trunk/html/packetsrv_8c-source.html#l00292

BR,
-- 
Éric Leblond, eleblond@inl.fr
Téléphone : 01 44 89 46 40, Fax : 01 44 89 45 01
INL, http://www.inl.fr

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: libipq and destination IP address

[Khoa Nguyen]

Hi,

Thanks for your response. Actually, the problem is inet_ntoa()
function -- I should have printed out the IP address right away before
calling the function again

Thanks,
Khoa

On 10/19/07, Eric Leblond <eric@inl.fr> wrote:
> Hi,
>
> Le mardi 16 octobre 2007 à 10:44 -0400, Khoa Nguyen a écrit :
> > Hi,
> >
> > I am writing a small libipq program to extract packet info. I "queued"
> > all packets in the OUTPUT chain. It looks like the packet has the same
> > source and destination packet ( = host interface address). Why is
> > that? Is there a way in libipq to extract the REAL destination
> > address?
>
> First of all: switch to libnetfilter_queue
>
> For your question, libipq sends to userspace the whole content of the
> packet. Thus there is no potential problem of address rewriting. You can
> have a look at the following code extract from NuFW:
> http://docs.nufw.org/doxygen/trunk/html/packetsrv_8c-source.html#l00292
>
> BR,
> --
> Éric Leblond, eleblond@inl.fr
> Téléphone : 01 44 89 46 40, Fax : 01 44 89 45 01
> INL, http://www.inl.fr
>
>