From: Ramin Dousti <ramin@cannon.eng.us.uu.net>
To: George Vieira <georgev@citadelcomputer.com.au>
Cc: Yoann <yoann.juet@ifrance.com>, netfilter@lists.netfilter.org
Subject: Re: help bootp filters
Date: Mon, 16 Jun 2003 10:41:16 -0400 [thread overview]
Message-ID: <20030616144116.GB30628@cannon.eng.us.uu.net> (raw)
In-Reply-To: <09B04A55822EFF4DA48D2E0BB2941D4A019285@wardrive.citadelcomputer.com.au>
On Mon, Jun 16, 2003 at 10:56:04PM +1000, George Vieira wrote:
> If I'm not wrong, I think tcpdump works on a different layer to netfilter so even though it's dropped I think tcpdump still sees them.... but I may be wrong.
> Does it eventually give out DHCP IP's or receives an IP addres or doesn't it? If DHCP isn't working then it's probably dropped but tcpdumps still sees them..
>
> I just did a test from work to home which I'm defiantely blockinh port 6665 and I get the same results but I know 6665 is being dropped... yet TCPDUMP catches it before netfilter.
>
> Jun 16 22:52:24 newjackswing kernel: INET IN=ppp0 OUT= MAC= SRC=203.111.79.114 DST=150.101.112.146 LEN=60 TOS=0x00 PREC=0xE0 TTL=50 ID=44842 DF PROTO=TCP SPT=3698 DPT=6665 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405840402080A0B09245F0000000001030300)
>
> [root@newjackswing /usr]# tcpdump -x port 6665
> Kernel filter, protocol ALL, datagram packet socket
> tcpdump: listening on all devices
> 22:52:24.984380 if134 < work.domain.com.3698 > myhome.domain.com.6665: S 614501237:614501237(0) win 5840 <mss 1412,sackOK,timestamp 185148511 0,nop,wscale 0> (DF) [tos 0xe0]
> 45e0 003c af2a 4000 3206 76d8 cb6f 4f72
> 9665 7092 0e72 1a09 24a0 8b75 0000 0000
> a002 16d0 0795 0000 0204 0584 0402 080a
> 0b09 245f 0000 0000 0103 0300
>
> So I think I might be right? Anybody wanna shed some light with this layer stuff ;) I'm confused on that part ;P
You are right. tcpdump would see the packets before any filter chains...
Ramin
prev parent reply other threads:[~2003-06-16 14:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-06-16 12:56 help bootp filters George Vieira
2003-06-16 13:09 ` Yoann
2003-06-16 15:40 ` Ramin Dousti
2003-06-16 14:41 ` Ramin Dousti [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030616144116.GB30628@cannon.eng.us.uu.net \
--to=ramin@cannon.eng.us.uu.net \
--cc=georgev@citadelcomputer.com.au \
--cc=netfilter@lists.netfilter.org \
--cc=yoann.juet@ifrance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox