libpcap (tcpdump) and netfilter (iptables)

libpcap (tcpdump) and netfilter (iptables)

[Pierre LEBRECH]

Hi,

It seems that even if I drop some INPUT packets with iptables, tcpdump
still sees these packets arriving on the ethernet interface.

Could anybody explain me a bit about this?

Thanks

Re: libpcap (tcpdump) and netfilter (iptables)

[Gáspár Lajos]

Hi!

Short answer: Yes. tcpdump sees every packet.

Long answer:

http://www.google.hu/search?q=iptables+tcpdump

http://mydebian.blogdns.org/?p=85

Swifty

Pierre LEBRECH írta:
> Hi,
>
> It seems that even if I drop some INPUT packets with iptables, tcpdump
> still sees these packets arriving on the ethernet interface.
>
> Could anybody explain me a bit about this?
>
> Thanks
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>
>   

Re: libpcap (tcpdump) and netfilter (iptables)

[Gáspár Lajos]

Hi!

Short answer: Yes. tcpdump sees every packet.

Long answer:

http://www.google.hu/search?q=iptables+tcpdump

http://mydebian.blogdns.org/?p=85

Swifty

Pierre LEBRECH írta:
> Hi,
>
> It seems that even if I drop some INPUT packets with iptables, tcpdump
> still sees these packets arriving on the ethernet interface.
>
> Could anybody explain me a bit about this?
>
> Thanks
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>
>   

Re: libpcap (tcpdump) and netfilter (iptables)

[Julien Vehent]

Hi,

On Wed, 29 Oct 2008 14:20:36 +0100, Pierre LEBRECH
<pierre.lebrech@laposte.net> wrote:
> Hi,
> 
> It seems that even if I drop some INPUT packets with iptables, tcpdump
> still sees these packets arriving on the ethernet interface.
> 
> Could anybody explain me a bit about this?

The pcap driver catch the packet before it's processed by netfilter. 
This is a known issue that has even been used in a rootkit PoC to
communicate with the rootkit before the firewall drops the packet.


> 
> Thanks
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Regards,

Julien

-- 
www.linuxwall.info

Re: libpcap (tcpdump) and netfilter (iptables)

[Thomas Jacob]

On Wed, 2008-10-29 at 15:00 +0100, Julien Vehent wrote:
> Hi,
> 
> On Wed, 29 Oct 2008 14:20:36 +0100, Pierre LEBRECH
> <pierre.lebrech@laposte.net> wrote:
> > Hi,
> > 
> > It seems that even if I drop some INPUT packets with iptables, tcpdump
> > still sees these packets arriving on the ethernet interface.
> > 
> > Could anybody explain me a bit about this?
> 
> The pcap driver catch the packet before it's processed by netfilter. 
> This is a known issue that has even been used in a rootkit PoC to
> communicate with the rootkit before the firewall drops the packet.

You may call it a "known issue", I'd called a very useful
and desirable feature for debugging network packet filters.

If you want to protect your machine against this issue, you
could simply disable  packet sockets, couldn't you?

Re: libpcap (tcpdump) and netfilter (iptables)

[Julien Vehent]

On Wed, 29 Oct 2008 16:11:25 +0100, Thomas Jacob <jacob@internet24.de>
wrote:
> On Wed, 2008-10-29 at 15:00 +0100, Julien Vehent wrote:
>> Hi,
>> 
>> On Wed, 29 Oct 2008 14:20:36 +0100, Pierre LEBRECH
>> <pierre.lebrech@laposte.net> wrote:
>> > Hi,
>> > 
>> > It seems that even if I drop some INPUT packets with iptables, tcpdump
>> > still sees these packets arriving on the ethernet interface.
>> > 
>> > Could anybody explain me a bit about this?
>> 
>> The pcap driver catch the packet before it's processed by netfilter. 
>> This is a known issue that has even been used in a rootkit PoC to
>> communicate with the rootkit before the firewall drops the packet.
> 
> You may call it a "known issue", I'd called a very useful
> and desirable feature for debugging network packet filters.
> 
> If you want to protect your machine against this issue, you
> could simply disable  packet sockets, couldn't you?

This is right, "issue" may not be the right term to use here...
Let's call it a "poorly documented feature". And in the case an attacker
has access to the root, the pcap lib should be the least of your
preoccupations...

Considering pcap is never install on production machines (at least, where I
work), I never had to worry about this. :)



> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
-- 
www.linuxwall.info