I want to capture ARP packets on ingress but I am having trouble understanding the current netfilter architecture. I have not been able to receive any ARP packets through NFQUEUE (using `arptables -A INPUT -j QUEUE`) using a modified nfqnl_test and I was wondering if this is currently supported or even possible. If so, what type of modifications must be made to nfqnl_test.c to receive them? Am I going to have to write a kernel module similar to ip_queue.c? (If its more complicated than that just say so; I'm still wrapping my head around the network and netfilter subsystems.) Following nfqnl_test.c I see that both nfq_open() and nfq_bind_pf() use AF_* enumerations, but nfqnl_recv_config() within the kernel, which I assume ultimately receives the NFQA_CFG_CMD message, indexes queue_handler with the given AF_* but would seem to expect NFPROTO_* enumerations, which are different (such as AF_AX25 and NFPROTO_ARP). Which enumeration is supposed to be used, AF_* or NFPROTO_*? -- Eric Branson California State University, Sacramento -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
