Very Computer

Hello

Does tcpdump on an interface see the packets that are filtered out by
iptables rules? Does it matter if it's in INPUT or FORWARD chain?

This is probably documented somewhere but I can't find (I do not feel
up to reading kernel source ;)
Thank a lot

Alex

No and yes.

 From the man page:

Tcpdump  prints  out  the  headers of packets on a network interface
that match the boolean expression.

Note that it only listens on an interface - i.e. the point at which the
packets enter or leave the computer.

If you know your iptables then you know that only the ouput chain of any
table is filtered; the correct sequence (for the standard filter table) is:

wire -> NIC -> tcpdump -> INPUT chain

and

OUPUT chain -> tcpdump -> NIC -> wire.

tcpdump listens in between the NIC and the iptables kernel code.

Quote:> This is probably documented somewhere but I can't find (I do not feel
> up to reading kernel source ;)

Then don't; even though iptables functionality is included in the kernel
the actual program is on www.netfilter.org.
Go there and be edified.

--
Jeroen Geilman

Analog bits courtesy of adaptr.

Thanks a lot. This note is missing from tcpdump 3.6 on redhat 7.2

I do enjoy reading well written docs - and netfilter guides are among my
favorites ;)

Alex

Quote:> If you know your iptables then you know that only the ouput chain of any
> table is filtered; the correct sequence (for the standard filter table) is:

> wire -> NIC -> tcpdump -> INPUT chain

> and

> OUPUT chain -> tcpdump -> NIC -> wire.

> tcpdump listens in between the NIC and the iptables kernel code.

> > This is probably documented somewhere but I can't find (I do not feel
> > up to reading kernel source ;)

> Then don't; even though iptables functionality is included in the kernel
> the actual program is on www.netfilter.org.
> Go there and be edified.