2

I've written my own packet sniffer in Linux.

I open a socket with socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) and then process the Ethernet packets - unpacking ARP packets, IP packets (and ICMP / TCP / UDP packets inside those).

This is all working fine so far.

Now I can read packets like this - and I can also inject packets by wrapping up a suitable Ethernet packet and sending it.

But what I'd like is a means to block packets - to consume them, as it were, so that they don't get further delivered into the system.

That is, if a TCP packet is being sent to port 80, then I can see the packet with my packet sniffer and it'll get delivered to the web server in the usual fashion.

But, basically, I'd like it that if I spot something wrong with the packet - not coming from the right MAC address, malformed in some way, or just breaking security policy - that I can just "consume" the packet, and it won't get further delivered onto the web server.

Because I can read packets and write packets - if I can also just block packets as well, then I'll have all I need.

Basically, I don't just want to monitor network traffic, but sometimes have control over it. E.g. "re-route" a packet by consuming the original incoming packet and then writing out a new slightly-altered packet to a different address. Or just plain block packets that shouldn't be being delivered at all.

My application is to be a general "network traffic management" program. Monitors and logs traffic. But also controls it too - blocking packets as a firewall, re-routing packets as a load balancer.

In other words, I've got a packet sniffer - but if it sniffs something that smells bad, then I'd like it to be able to stop that packet. Discard it early, so it's not further delivered anywhere.

(Being able to alter packets on the way through might be handy too - but if I can block, then there's always the possibility to just block the original packet completely, but then write out a new altered packet in its place.)

Bob
  • 71
  • 6

2 Answers2

2

What you are looking for is libnetfilter_queue. The documentation is still incredibly bad, but the code in this example should get you started.

I used this library to develop a project that queued network packets and replayed them at a later time.

0

A bit of a tangent, but it was relevant when I was resolving my problem. Blocking raw packets is relatively complicated, so it might make sense to consider doing that at a different layer. In other words, does your cloud provider let you set up firewall rules to drop specific kind of traffic?

In my case it was easier to do, which is why I'm suggesting such a lateral solution.

d33tah
  • 10,999
  • 13
  • 68
  • 158
  • At the time I was doing this, I was running my own cluster of servers and did have firewall rules set up, of course. Somewhat the idea here was that I was looking into creating a singular "network traffic management" daemon to do the whole job - firewall, packet router / load balancer, etc. (with potential for on-the-fly "learning" too, maybe) - dynamically in one place, rather than have a dozen static text files in "/etc". I changed jobs since, but applying my coding to make the net admin job a whole lot easier was where I was going at the time. – Bob Apr 08 '22 at 10:35