I would like to immediately process certain types of packets if/when they arrive with a custom (bash) script.

As NetFilter is kernel space, I understand I need to look for a userspace logging tools so I set my eyes on ulogd (v.2). Unfortunately I can not find functionality that would let me handle incoming packets.

I could let ulogd output into a file, and set a separate process that monitors that file, but it seems to me too much convoluted and complex.

Is there an option to nft or ulogd that I missed, that would let me fire a script any time a certain packet was encountered?

  • Do you need the logging? You can just redirect packets to a user-space process to handle them. – Khaled Dec 13 '18 at 11:46
  • @Khaled I don't need logging. Is there a tool I can use, or should I write my own in C++ using libnetfilter? – Adam Ryczkowski Dec 13 '18 at 20:11

It depends on what you want to do. I have two options in mind:

  1. Write your own application to handle the packets of interest in completely user-space. Netfilter will just forward the matching packets to your application for processing. This provides you with full control to inspect the packet and then decide what to do.
  2. Use the well-known netfilter LOG target and use a tool fail2ban to catch the log entries and process them as required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.