Messages in this thread | | | Date | Wed, 17 Nov 2004 22:38:43 +0100 | From | Harald Welte <> | Subject | Re: Packet capturing, iptables and eth0 vs. dummy0 |
| |
On Wed, Nov 17, 2004 at 09:30:33PM +0100, DervishD wrote: > Hi all :)
Hi!
please send netfilter/iptables related questions to the respective lists: netfilter@lists.netfilter.org (for user questions) netfilter-devel@lists.netfilter.org (for development issues)
> I've noticed that, no matter what filtering is iptables doing, > tcpdump gets all packets from interface eth0 as seen in the bus,
This is correct. iptables is a IPv4 packet filter. It is part of the IPv4 stack. tcpdump uses PF_PACKET which attaches right above the NIC driver, therefore you capture packets way before they enter the IPv4 stack.
> Raúl Núñez de Arenas Coronado -- - Harald Welte <laforge@gnumonks.org> http://www.gnumonks.org/ ============================================================================ Programming is like sex: One mistake and you have to support it your lifetime [unhandled content-type:application/pgp-signature] | |