iptables promisc mode

["Magnus Månsson" <ganja@0x63.nu>]

Hi, it seems like a couple of people have asked for this before but I 
havent seen any answers.

I want iptables to get packages that do not belong to the machine, 
packages that are directed to others but came to me due to promisc mode. 
I have found a patch from November 2001 that seems to do what I want but 
after manually trying to patch it in my userspace utils segfaults. I am 
not a programmer so no surprise I didnt manage. The old patch is here: 
http://idea.hosting.lv/a/iptables-promisc/


So, why do I want this? (maybe you can tell me that I should do it in 
another way)
I am having a routing switch that is mirroring the internet traffic into 
2 interfaces in a linux machine, this machine is for example running 
ntop to look at what people are doing (that they shouldnt do). One of 
the things I/we are interested to find out is if people uses peer to 
peer protocols like Direct Connect / Bittorrent. My idea was to solve 
this with iptables layer7 filter (l7-filter.sourceforge.net), ulogd and 
mysql. But since I cant build ULOG rules that catch the packages I am stuck.

The reason to choose iptables is that I can store all the information 
about the protocols I am interested in. Ntop doesnt have the history 
that I want.


I am very thankful for whatever help/directions I can get.

--
Magnus Månsson