Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use tcpdump to capture output packets for one server, but I also need to block these packets.

If I use iptables to block them, then I also can not capture anything.

Can I block packets with iptables and still capture the packets before they are dropped?

share|improve this question

4 Answers 4

up vote 2 down vote accepted

I'd use a passive (un-addressed) interface to capture, and a second interface (addressed) to block.

To setup an interface for capture, without an address, you do: ifconfig eth0 up

You may need to hack on your switch to make this all fly, but the essence is: mirror all traffic to both interfaces (i.e. switch ports), and then capture on the one, and filter on the other.

share|improve this answer

You could use a fairly simple snort ruleset to "log" packets as well as drop or refuse them: Snort. However, there are several prerequisites and it is yet another syntax to learn so there is quite an overhead. Snort :: Docs has quick-start guides for several different operating systems.

share|improve this answer

if i understand, you want to block connection but capture packets.

you can do this by using MARKS

for example if you want block connection for host 192.168.10.1 with connection 192.168.10.2(*nix) you can do with this

iptables -t mangle -A PREROUTING -s 192.168.10.1 -j CONNMARK --set-mark 1
iptables -t mangle -A POSTROUTING -m connmark --mark 1 -j DROP
share|improve this answer
    
Thanks! Can i block gre packets but can capture them with this rule ? –  larry Nov 30 '10 at 11:21
    
but i can capture input packets, but can not capture the output packets :( –  larry Nov 30 '10 at 11:35

You cannot block packets on the raw socket, because there is no filter for it currently. Above all, the raw socket gets the packet, in fact, even a copy of the packet, before the IPv4 tap and iptables do get theirs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.