how to simulate network problems with iptables

To test an Application that communicates over UDP Multicast I would
like to filter out some packets using iptables. However, when I
specify a rule to DROP the packets on send, the application gets an
"Operation not permitted" error. What I would like to achieve is that
the packet gets silently dropped, without the application on the local
machine getting an immediate error.

erwin wrote:
> To test an Application that communicates over UDP Multicast I would
> like to filter out some packets using iptables. However, when I
> specify a rule to DROP the packets on send, the application gets an
> "Operation not permitted" error. What I would like to achieve is that
> the packet gets silently dropped, without the application on the local
> machine getting an immediate error.

put a box up in between the host and the rest of the network

that's no option for me, in my case the box is multiply redundant on
several switches, I have no easy access to the network infrastructure
(nor even to the physical box).- that's why I would like to do it with
filtering locally on the box.

goarilla <kevin<punt>paulus|@|skynet schrieb:
> erwin wrote:
> > To test an Application that communicates over UDP Multicast I would
> > like to filter out some packets using iptables. However, when I
> > specify a rule to DROP the packets on send, the application gets an
> > "Operation not permitted" error. What I would like to achieve is that
> > the packet gets silently dropped, without the application on the local
> > machine getting an immediate error.
>
> put a box up in between the host and the rest of the network

Hello,

erwin a écrit :
> To test an Application that communicates over UDP Multicast I would
> like to filter out some packets using iptables. However, when I
> specify a rule to DROP the packets on send, the application gets an
> "Operation not permitted" error. What I would like to achieve is that
> the packet gets silently dropped, without the application on the local
> machine getting an immediate error.

At worst if it's not loopback traffic you can use the MARK target with
advanced routing to route discarded packets through a dummy interface.