Networking Forums

Networking Forums > Computer Networking > Linux Networking > packet drop notifications -?

Reply
Thread Tools Display Modes

packet drop notifications -?

 
 
chcat
Guest
Posts: n/a

 
      12-08-2011, 02:24 PM
Hello,
I am looking for the approach to receive notifications in application
code when linux firewall drops the packet.
Can it be done without changes in kernel code?
Thanks....
 
Reply With Quote
 
 
 
 
Richard Kettlewell
Guest
Posts: n/a

 
      12-08-2011, 02:43 PM
chcat <(E-Mail Removed)> writes:
> I am looking for the approach to receive notifications in application
> code when linux firewall drops the packet.
> Can it be done without changes in kernel code?
> Thanks....


Add a LOG rule before each DROP rule, and then monitor the kernel log
output.

--
http://www.greenend.org.uk/rjk/
 
Reply With Quote
 
Jorgen Grahn
Guest
Posts: n/a

 
      12-08-2011, 02:57 PM
On Thu, 2011-12-08, Richard Kettlewell wrote:
> chcat <(E-Mail Removed)> writes:
>> I am looking for the approach to receive notifications in application
>> code when linux firewall drops the packet.
>> Can it be done without changes in kernel code?
>> Thanks....

>
> Add a LOG rule before each DROP rule, and then monitor the kernel log
> output.


I seem to recall there are other actions which can be used too ...
Depends on what he wants to do.

(I once wanted to play a "plonk" sound every time, but never got
around to implementing it.)

/Jorgen

--
// Jorgen Grahn <grahn@ Oo o. . .
\X/ snipabacken.se> O o .
 
Reply With Quote
 
chcat
Guest
Posts: n/a

 
      12-10-2011, 12:51 PM
On Dec 8, 10:43*am, Richard Kettlewell <r...@greenend.org.uk> wrote:
> chcat <vlyamt...@gmail.com> writes:
> > I am looking for the approach to receive notifications in application
> > code when linux firewall drops the packet.
> > Can it be done without changes in kernel code?
> > Thanks....

>
> Add a LOG rule before each DROP rule, and then monitor the kernel log
> output.
>
> --http://www.greenend.org.uk/rjk/


Are there other methods that wouldn't require changes of existing
RULES ? I am interested more in the terms of programmatic "hooks"...
Thanks.
 
Reply With Quote
 
Jorgen Grahn
Guest
Posts: n/a

 
      12-10-2011, 03:54 PM
On Sat, 2011-12-10, chcat wrote:
> On Dec 8, 10:43*am, Richard Kettlewell <r...@greenend.org.uk> wrote:
>> chcat <vlyamt...@gmail.com> writes:
>> > I am looking for the approach to receive notifications in application
>> > code when linux firewall drops the packet.
>> > Can it be done without changes in kernel code?
>> > Thanks....

>>
>> Add a LOG rule before each DROP rule, and then monitor the kernel log
>> output.


> Are there other methods that wouldn't require changes of existing
> RULES ? I am interested more in the terms of programmatic "hooks"...


Why would there be one? iptables(8) says

ACCEPT means to let the packet through. DROP means to drop the
packet on the floor. QUEUE means to pass the packet to
userspace.

They have little reason to add this functionality to DROP, when it's
already available and called QUEUE. (Not counting the many extension
targets, one of which may suit you better, depending on what you want
to do.)

/Jorgen

--
// Jorgen Grahn <grahn@ Oo o. . .
\X/ snipabacken.se> O o .
 
Reply With Quote
 
chcat
Guest
Posts: n/a

 
      12-11-2011, 01:58 PM
On Dec 10, 11:54*am, Jorgen Grahn <grahn+n...@snipabacken.se> wrote:
> On Sat, 2011-12-10, chcat wrote:
> > On Dec 8, 10:43*am, Richard Kettlewell <r...@greenend.org.uk> wrote:
> >> chcat <vlyamt...@gmail.com> writes:
> >> > I am looking for the approach to receive notifications in application
> >> > code when linux firewall drops the packet.
> >> > Can it be done without changes in kernel code?
> >> > Thanks....

>
> >> Add a LOG rule before each DROP rule, and then monitor the kernel log
> >> output.

> > Are there other methods that wouldn't require changes of existing
> > RULES ? I am interested more in the terms of programmatic "hooks"...

>
> Why would there be one? iptables(8) says
>
> * * * *ACCEPT means to let the packet through. *DROP means to drop the
> * * * *packet on the floor. *QUEUE means to pass the packet to
> * * * *userspace.
>
> They have little reason to add this functionality to DROP, when it's
> already available and called QUEUE. (Not counting the many extension
> targets, one of which may suit you better, depending on what you want
> to do.)
>
> /Jorgen
>
> --
> * // Jorgen Grahn <grahn@ *Oo *o. * . * * .
> \X/ * * snipabacken.se> * O *o * .


Sorry if i did not state the problem clearly enough...
Iptables firewall is already running on the system.
The application in question, or its user cannot change iptables rules.
That's up to firewall admin.
The application needs approximate count of packet drop by firewall per
second.
Any suggestions?
Thanks in any case.
 
Reply With Quote
 
Jorgen Grahn
Guest
Posts: n/a

 
      12-11-2011, 02:23 PM
On Sun, 2011-12-11, chcat wrote:
> On Dec 10, 11:54*am, Jorgen Grahn <grahn+n...@snipabacken.se> wrote:
>> On Sat, 2011-12-10, chcat wrote:
>> > On Dec 8, 10:43*am, Richard Kettlewell <r...@greenend.org.uk> wrote:
>> >> chcat <vlyamt...@gmail.com> writes:
>> >> > I am looking for the approach to receive notifications in application
>> >> > code when linux firewall drops the packet.
>> >> > Can it be done without changes in kernel code?
>> >> > Thanks....

>>
>> >> Add a LOG rule before each DROP rule, and then monitor the kernel log
>> >> output.
>> > Are there other methods that wouldn't require changes of existing
>> > RULES ? I am interested more in the terms of programmatic "hooks"...

>>
>> Why would there be one? iptables(8) says
>>
>> * * * *ACCEPT means to let the packet through. *DROP means to drop the
>> * * * *packet on the floor. *QUEUE means to pass the packet to
>> * * * *userspace.
>>
>> They have little reason to add this functionality to DROP, when it's
>> already available and called QUEUE. (Not counting the many extension
>> targets, one of which may suit you better, depending on what you want
>> to do.)


> Sorry if i did not state the problem clearly enough...
> Iptables firewall is already running on the system.
> The application in question, or its user cannot change iptables rules.
> That's up to firewall admin.


This sounds like a problem. I think it is unlikely that you'll find a
way to do things to the iptables which do not require the cooperation
of the admin.

> The application needs approximate count of packet drop by firewall per
> second.


That is a humble wish (little security or privacy impact) but it seems
unlikely that you can do anything unless you at least have access to
the logs.

Note though that I'm not an expert; perhaps someone else can explain
the issues better.

/Jorgen

--
// Jorgen Grahn <grahn@ Oo o. . .
\X/ snipabacken.se> O o .
 
Reply With Quote
 
Jamma Tino Schwarze
Guest
Posts: n/a

 
      12-13-2011, 03:30 PM
Hi chcat,

chcat <(E-Mail Removed)> wrote:

> I am looking for the approach to receive notifications in application
> code when linux firewall drops the packet.


You want the notification exactly where? In sending application? Then
don't use DROP, use REJECT. It causes ICMP replies to be sent.

Jamma.

--
"What we nourish flourishes." - "Was wir nähren erblüht."

www.tisc.de
 
Reply With Quote
 
 
 
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
NetMon notifications David Webb Windows Networking 0 09-10-2008 03:51 PM
wireless packet drop Thufir Linux Networking 0 06-16-2007 08:47 AM
UDP Packet drop catbacker@gmail.com Windows Networking 2 03-08-2007 12:23 AM
Connection Notifications JamesP Wireless Networks 3 08-30-2005 12:10 AM
How can my application receive PnP notifications from a n/w device Networking Developer Wireless Networks 1 11-24-2004 11:34 PM



1 2 3 4 5 6 7 8 9 10 11