Hi, it seems like a couple of people have asked for this before but I
havent seen any answers.
I want iptables to get packages that do not belong to the machine,
packages that are directed to others but came to me due to promisc mode.
I have found a patch from November 2001 that seems to do what I want but
after manually trying to patch it in my userspace utils segfaults. I am
not a programmer so no surprise I didnt manage. The old patch is here:
http://idea.hosting.lv/a/iptables-promisc/
So, why do I want this? (maybe you can tell me that I should do it in
another way)
I am having a routing switch that is mirroring the internet traffic into
2 interfaces in a linux machine, this machine is for example running
ntop to look at what people are doing (that they shouldnt do). One of
the things I/we are interested to find out is if people uses peer to
peer protocols like Direct Connect / Bittorrent. My idea was to solve
this with iptables layer7 filter (l7-filter.sourceforge.net), ulogd and
mysql. But since I cant build ULOG rules that catch the packages I am stuck.
The reason to choose iptables is that I can store all the information
about the protocols I am interested in. Ntop doesnt have the history
that I want.
I am very thankful for whatever help/directions I can get.
--
Magnus Månsson
