Re: libpcap (tcpdump) and netfilter (iptables)

[Julien Vehent <julien@linuxwall.info>]

On Wed, 29 Oct 2008 16:11:25 +0100, Thomas Jacob <jacob@internet24.de>
wrote:
> On Wed, 2008-10-29 at 15:00 +0100, Julien Vehent wrote:
>> Hi,
>> 
>> On Wed, 29 Oct 2008 14:20:36 +0100, Pierre LEBRECH
>> <pierre.lebrech@laposte.net> wrote:
>> > Hi,
>> > 
>> > It seems that even if I drop some INPUT packets with iptables, tcpdump
>> > still sees these packets arriving on the ethernet interface.
>> > 
>> > Could anybody explain me a bit about this?
>> 
>> The pcap driver catch the packet before it's processed by netfilter. 
>> This is a known issue that has even been used in a rootkit PoC to
>> communicate with the rootkit before the firewall drops the packet.
> 
> You may call it a "known issue", I'd called a very useful
> and desirable feature for debugging network packet filters.
> 
> If you want to protect your machine against this issue, you
> could simply disable  packet sockets, couldn't you?

This is right, "issue" may not be the right term to use here...
Let's call it a "poorly documented feature". And in the case an attacker
has access to the root, the pcap lib should be the least of your
preoccupations...

Considering pcap is never install on production machines (at least, where I
work), I never had to worry about this. :)



> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
-- 
www.linuxwall.info