RE: [LI] Can we look into IP packets throu

[LENGARD Pascal OCISI <pascal.lengard@xxxxxxxxxxxxxxxx>]

> hi!!
>      as I know we can put firewall on linix using ipchains &
> we can also
>   log a packets for any site ,but is there any way of finding
> what were the
>   contents in those packets
>
>   the logged packed look like this ::
>
> Packet log: input DENY eth0 PROTO=17 192.168.2.1:53 192.168.1.1:1025
>        L=34 S=0x00 I=18 F=0x0000 T=254
>
>     which says the packet lenght was 34 ,
>
>     but how could I see the orignal content in this packet ??
>
>  thanks in advance!!
this looks like a DNS reply from 192.168.2.1 named daemon (port 53).

to catch this packet, if you can reproduce it, the easiest is to use   
tcpdump and
tell it to capture all port 53 packet for host 192.168.1.1 for example.

i believe you could also use this feature in the kernel:
IP: firewall packet netlink device
CONFIG_IP_FIREWALL_NETLINK
  If you say Y here, you can use the ipchains tool to copy all or part
  of any packet you specify that hits your Linux firewall to optional
  user space monitoring software that can then look for attacks and
  take actions such as paging the administrator of the site.

  To use this, you need to create a character special file under /dev
  with major number 36 and minor number 3 using mknod ("man mknod"),
  and you need (to write) a program that reads from that device and
  takes appropriate action.

pascal  
--------------------------------------------------------------------
The Linux India Mailing List Archives are now available.  Please search
the archive at http://lists.linux-india.org/ before posting your question
to avoid repetition and save bandwidth.