hello, using iptables i wanted do drop all incoming udp packets, but i don't know why wireshark see all this packets. Moreover says that packets were droped. asked 11 Jun '11, 16:03  azazzel01 |
2 Answers:
One basic rule of network analysis is that you never run the analysis tool on the same system as the device under test (or device under suspicion) as that might nog give you the right picture (as you are experiencing). What you would want to do is run wireshark twice on systems on span/mirror ports that span/mirror the traffic on the outside and inside interfaces of the system running iptables. Then you can see the effect and effectiveness of the iptables rules in place. answered 11 Jun '11, 22:04  SYN-bit ♦♦ |
My guess is that libpcap captures the packets just before they get processed (and blocked if UDP) by your iptables engine. If your iptables machine is routing the packets you might wanna check on the other side if they exit as well (in which case your iptables has a problem). If it is an endpoint you should check if any UDP packet ever gets answered - either by an UDP packet if there is a service on that port, or an ICMP port unreachable packet if there is not. If you see none of these reply packets dropping the UDP packets obviously works. answered 11 Jun '11, 16:21  Jasper ♦♦ yes, You are right i have found some information, that libpcap works just before netfilter and that's why wireshark see all the packets. I have chaced it using: and iptables shows that the packets were dropped but it doesn't solve my problem. I wrote simple C program which sends udp packets to some other computer (with iptables dropping) and i need to know exactly which packets were dropped. Because wireshark shows all packets and iptables shows only number of dropped packets is it possible to check it ? Thank You for help and sorry for my english, i am not native english speaker. (11 Jun '11, 17:09) azazzel01 |
ok, thanks for help. I have just did it using ulogd and plugin to id ulogd-pcap. In this way iptables creates a pcap file with packets which were not dropped and it can be easiy open by wireshark.