Netfilter and Tcpdump
sowmya.sridharan at tcs.com
Mon Apr 11 02:02:11 EDT 2011
I was analyzing some tcpdump data, and noticed that it also captured
packets mangled by Netfilter hooks.
Theoretically I know that the pcap library takes off the packets from
ethernet driver level and with the help of
the dynamic filters set by userspace, we are able to see those packets via
But aren't netfilter hooks attached at a higher level, namely the network
stack? If so, then how is the pcap library able to
sniff those packets as well? Is it like the pcap library just holds a
reference to the packets it takes from the driver, or
does it maintain a separate copy for displaying?
Any answers/clarifications would be much appreciated.
Notice: The information contained in this e-mail
message and/or attachments to it may contain
confidential or privileged information. If you are
not the intended recipient, any dissemination, use,
review, distribution, printing or copying of the
information contained in this e-mail message
and/or attachments to it are strictly prohibited. If
you have received this communication in error,
please notify us by reply e-mail or telephone and
immediately and permanently delete the message
and any attachments. Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Kernelnewbies