How to differentiate packets generated locally or received from t he network using the NF_IP_PRE_ROUTING filter

How to differentiate packets generated locally or received from t he network using the NF_IP_PRE_ROUTING filter

[George Gao]

[-- Attachment #1: Type: text/plain, Size: 476 bytes --]

Hi there,
     I'm working on the sample Netfilter driver to put something together
for a prototype. I ran into a problem which I wish you can help me out. When
I set my input filter hook number to NF_IP_PRE_ROUTING, I saw local
generated IP multicast/Broadcast packets and inbound packets from network.
Is there any way to differentiate a local IP Multicast or IP brocast from an
inbound mal-formed packet with the exact same content? Thanks much in
advance!
Cheers!
George 

[-- Attachment #2: Type: text/html, Size: 1035 bytes --]

Re: How to differentiate packets generated locally or received from the network using the NF_IP_PRE_ROUTING filter

[Antony Stone]

On Monday 05 April 2004 11:02 pm, George Gao wrote:

> Hi there,
>      I'm working on the sample Netfilter driver to put something together
> for a prototype. I ran into a problem which I wish you can help me out.
> When I set my input filter hook number to NF_IP_PRE_ROUTING, I saw local
> generated IP multicast/Broadcast packets and inbound packets from network.
> Is there any way to differentiate a local IP Multicast or IP brocast from
> an inbound mal-formed packet with the exact same content? Thanks much in
> advance!

Um, what do you mean by "malformed"?

The most obvious difference I can think of between a Multicast packet, a 
Broadcast packet, and a "normal" (Unicast) packet is the destination address, 
so is there some reason why you can't use this to distinguish them?

Regards,

Antony.

-- 
"Linux is going to be part of the future. It's going to be like Unix was."

 - Peter Moore, Asia-Pacific general manager, Microsoft

                                                     Please reply to the list;
                                                           please don't CC me.

Re: How to differentiate packets generated locally or received from t he network using the NF_IP_PRE_ROUTING filter

[Philip Craig]

George Gao wrote:
> Is there any way to differentiate a local IP Multicast or IP brocast from an
> inbound mal-formed packet with the exact same content? Thanks much in
> advance!

Use '-m pkttype --pkt-type multicast' and '-m pkttype --pkt-type broadcast'.

-- 
Philip Craig - SnapGear, A CyberGuard Company - http://www.SnapGear.com