How to captuare an IP packet, change its content and resend it on Linux?

Question

My question is:

How to captuare an incoming IP packet from a network interface, change its content and resend it from another network interface?

Answer 1

The choice is yours, there is no preference (and hence no "normal").

• using libnetfilter_queue to deliver to userspace and do extensive modification there.
• or an xtables module, also works (since it's called by NF anyway). Allows for sufficient fine-grained configuration with help from userspace.
• nfhook module, if you must. All configuration you must implement yourself.
• well and finally, if you like things that hurt, you might as well implement your own virtual NIC driver.

Answer 2

The usual way of doing something like this is to create a netfilter hook module.

See this example for a quick start.

Answer 3

You don't mention what you intend to change exactly, which makes it difficult to answer your question properly.

For content substitution on a router kind of device (guess), netsed might be the simplest approach available.