linux - Can I intercept network packets with a raw socket (not only sniff)? -
this first time using raw sockets (yes, need use them must modify field inside network header) , documentation or tutorials read describe solution sniff packets not need. need create script intercepts packet, process , sends further destination, i.e. packets should not reach destination unless script decides to.
in order learn, created small prototype detects pings , prints "ping". expect ping not work intercept packets , don't include logic send them destination. ping working (again, seems sniffing/mirroring packets). goal ping packets "trapped" in script , don't know how that. in current python script (i avoid writing how decode simplicity)
sock = socket.socket(socket.af_packet, socket.sock_raw, socket.ntohs(0x0003)) sock.bind((eth0, 0)) packet = sock.recvfrom(65565) decode_eth(packet) decode_ip(packet) if (ipheader.ip_proto == 1): print("\nping")
can explain how can achieve goal or point me right documentation?
your description seems different title suggest. understanding want receive, modify , possibly drop incoming network packets. , done on linux. in case suggest use netfilter prerouting hook, make things lot simpler (and more stable). netfilter documented, nice overview including information related requirements can seen here. important function use nf_register_hook(), read answer this question idea of how set things up.
Comments
Post a Comment