* TCP ack in libnetfilter_queue
@ 2010-09-23 14:12 Mistick Levi
2010-09-26 5:53 ` Fwd: " Mistick Levi
0 siblings, 1 reply; 4+ messages in thread
From: Mistick Levi @ 2010-09-23 14:12 UTC (permalink / raw)
To: netfilter
Hey,
i wrote a filter using libnetfilter_queue api, and i want to send
messages to the queue in a specific way...
I want to get the first packet after the TCP 3-way-handshak is
finished ( meaning - only data!)..
i tried using conntrack with "ESTABLISHED" status, but then i start
getting messages to the queue from the last message of the
handshake... ( meaning the last ack )... and i dont want that since it
contain no data....
any help will be appreciated.. thanks.
Yechiel Levi
^ permalink raw reply [flat|nested] 4+ messages in thread
* Fwd: TCP ack in libnetfilter_queue
2010-09-23 14:12 TCP ack in libnetfilter_queue Mistick Levi
@ 2010-09-26 5:53 ` Mistick Levi
2010-09-27 7:41 ` Eric Leblond
0 siblings, 1 reply; 4+ messages in thread
From: Mistick Levi @ 2010-09-26 5:53 UTC (permalink / raw)
To: netfilter-devel
Hi,
did'nt get any reply on the users list.... Hope anyone here could help out.
---------- Forwarded message ----------
From: Mistick Levi <gmistick@gmail.com>
Date: Thu, Sep 23, 2010 at 4:12 PM
Subject: TCP ack in libnetfilter_queue
To: netfilter@vger.kernel.org
Hey,
i wrote a filter using libnetfilter_queue api, and i want to send
messages to the queue in a specific way...
I want to get the first packet after the TCP 3-way-handshak is
finished ( meaning - only data!)..
i tried using conntrack with "ESTABLISHED" status, but then i start
getting messages to the queue from the last message of the
handshake... ( meaning the last ack )... and i dont want that since it
contain no data....
any help will be appreciated.. thanks.
Yechiel Levi
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Fwd: TCP ack in libnetfilter_queue
2010-09-26 5:53 ` Fwd: " Mistick Levi
@ 2010-09-27 7:41 ` Eric Leblond
[not found] ` <AANLkTikkDCufxM1p5g+SzNZZ171pe6J_a8YdpTigscbj@mail.gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Eric Leblond @ 2010-09-27 7:41 UTC (permalink / raw)
To: Mistick Levi; +Cc: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 1207 bytes --]
Hi,
Le dimanche 26 septembre 2010 à 07:53 +0200, Mistick Levi a écrit :
> Hi,
> did'nt get any reply on the users list.... Hope anyone here could help out.
>
>
> ---------- Forwarded message ----------
> From: Mistick Levi <gmistick@gmail.com>
> Date: Thu, Sep 23, 2010 at 4:12 PM
> Subject: TCP ack in libnetfilter_queue
> To: netfilter@vger.kernel.org
>
>
> Hey,
>
> i wrote a filter using libnetfilter_queue api, and i want to send
> messages to the queue in a specific way...
> I want to get the first packet after the TCP 3-way-handshak is
> finished ( meaning - only data!)..
>
> i tried using conntrack with "ESTABLISHED" status, but then i start
> getting messages to the queue from the last message of the
> handshake... ( meaning the last ack )... and i dont want that since it
> contain no data....
What about filtering on PSH, something like:
iptables XXXXX --tcp-flags PSH, PSH -j NFQUEUE
Not really strict but it should work in most case.
Or you can work on packet length, if it has data it is bigger:
iptables XXXXX --length 60:1500 -j NFQUEUE
BR,
--
Éric Leblond <eric@inl.fr>
EdenWall, http://www.edenwall.com/
NuFW, http://www.nufw.org
[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 197 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Fwd: Fwd: TCP ack in libnetfilter_queue
[not found] ` <AANLkTikkDCufxM1p5g+SzNZZ171pe6J_a8YdpTigscbj@mail.gmail.com>
@ 2010-09-27 8:11 ` Mistick Levi
0 siblings, 0 replies; 4+ messages in thread
From: Mistick Levi @ 2010-09-27 8:11 UTC (permalink / raw)
To: netfilter-devel
Hi,
Thanks for the reply, i'll give it a go..
but i was wondering if maybe there should be added a new FLAG for the
connection tracking... since i belive most people think that
"ESTABLISHED" mean's after the 3way handshake and the start of the
session....
any Idea's on why is the "ESTABLISHED" state is on before the 3-way
handshake is finished... or maybe there is another flag that would
help?
Thanks in advance..
Yechiel Levi
2010/9/27 Eric Leblond <eric@inl.fr>:
> Hi,
>
> Le dimanche 26 septembre 2010 à 07:53 +0200, Mistick Levi a écrit :
>> Hi,
>> did'nt get any reply on the users list.... Hope anyone here could help out.
>>
>>
>> ---------- Forwarded message ----------
>> From: Mistick Levi <gmistick@gmail.com>
>> Date: Thu, Sep 23, 2010 at 4:12 PM
>> Subject: TCP ack in libnetfilter_queue
>> To: netfilter@vger.kernel.org
>>
>>
>> Hey,
>>
>> i wrote a filter using libnetfilter_queue api, and i want to send
>> messages to the queue in a specific way...
>> I want to get the first packet after the TCP 3-way-handshak is
>> finished ( meaning - only data!)..
>>
>> i tried using conntrack with "ESTABLISHED" status, but then i start
>> getting messages to the queue from the last message of the
>> handshake... ( meaning the last ack )... and i dont want that since it
>> contain no data....
>
> What about filtering on PSH, something like:
> iptables XXXXX --tcp-flags PSH, PSH -j NFQUEUE
> Not really strict but it should work in most case.
> Or you can work on packet length, if it has data it is bigger:
> iptables XXXXX --length 60:1500 -j NFQUEUE
>
> BR,
> --
> Éric Leblond <eric@inl.fr>
> EdenWall, http://www.edenwall.com/
> NuFW, http://www.nufw.org
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-09-27 8:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-09-23 14:12 TCP ack in libnetfilter_queue Mistick Levi
2010-09-26 5:53 ` Fwd: " Mistick Levi
2010-09-27 7:41 ` Eric Leblond
[not found] ` <AANLkTikkDCufxM1p5g+SzNZZ171pe6J_a8YdpTigscbj@mail.gmail.com>
2010-09-27 8:11 ` Fwd: " Mistick Levi
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.