This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

on my linux, i wrote this rule for change all udp destination ip address to 8.8.8.8 when dport is 53:

iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8

this rule worked when i use:

dig +short iranled.com @4.2.2.4

tcpdump and wireshark output is:

04:42:38.023348 IP 192.168.1.2.48984 > 8.8.8.8.53: UDP, length 29
04:42:38.242241 IP 8.8.8.8.53 > 192.168.1.2.48984: UDP, length 45

it is ok.

but when i create this packet from scapy, iptables modify this packet but wireshark can not see them:

sr1(IP(dst="4.2.2.4")/UDP()/DNS(rd=1,qd=DNSQR(qname="iranled.com")))

tcpdump and wireshark output is:

04:43:00.442453 IP 192.168.1.2.53 > 4.2.2.4.53: UDP, length 29
04:43:00.855930 IP 4.2.2.4.53 > 192.168.1.2.53: UDP, length 45

why wireshark can't see scapy packet after changed by iptables?

asked 16 Jul '14, 12:05

Babyy's gravatar image

Babyy
476236
accept rate: 0%

edited 16 Jul '14, 12:16

why wireshark can't see scapy packet after changed by iptables?

how do you know the packet was changed by iptables in the test with scapy?

(16 Jul '14, 13:03) Kurt Knochner ♦

@Kurt Knochner: yeah! packet no changed !!!!

(16 Jul '14, 13:46) Babyy

and that means what exactly?

(16 Jul '14, 14:53) Kurt Knochner ♦

@Kurt Knochner: that means iptables cannot change scapy packets! is correct?

(17 Jul '14, 05:06) Babyy

that means iptables cannot change scapy packets! is correct?

I don't know. That was not a statement of mine. It was a question.

I was asking how do you know that iptables did change the scapy packet or not. The only way: Don't sniff on the system. Instead sniff on a mirror port of the switch.

Only then you will get more information if it is a problem with iptables or with libpcap (tcpdump/Wireshark) and (possibly) the fact that scapy is using RAW sockets.

(17 Jul '14, 05:27) Kurt Knochner ♦
1

scapy use raw socket and iptables is unable to block or modify those packets .. http://diablohorn.wordpress.com/2013/11/28/qp-raw-sockets-iptables/

(20 Jul '14, 12:51) Babyy
showing 5 of 6 show 1 more comments
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×7

question asked: 16 Jul '14, 12:05

question was seen: 4,380 times

last updated: 20 Jul '14, 12:51

p​o​w​e​r​e​d by O​S​Q​A