Using netgraph for filtering/modifing packets

[Julian Elischer]

On Mon, 14 Jun 2004, James Housley wrote:

> For testing of a product I would like to be able to modify or even drop
> packets based on their content.  What I have in mind is forcing the
> packets through a firewall that would redirect all packet to a netgraph
> node that would either pass unchanged, drop or change the contents to
> assist in testing some corner cases in the code.
> 
> 1) is this something doable with netgraph, I believe it is.

yes


> 
> 2) what might be a good place to start?  Have done some searching, but
> haven't found any example code I thought I could start from.

What sort of filter do you need?

you can pass packets to netgraph from ipfw by diverting them and
openning a divert socket with teh ksocket node..

Or you can pick them directly from the network interface
and filter yourself using the 'bpf' node type to select 
on something.
or you can use the etf type of node to filter on a particular 
ethertype..

there are a lot of options but I don't knw your application enough :-)

Julian


> 
> Thanks,
> Jim
> 
> -- 
> /"\   ASCII Ribbon Campaign  .
> \ / - NO HTML/RTF in e-mail  .
>    X  - NO Word docs in e-mail .
> / \ -----------------------------------------------------------------
> jeh at FreeBSD.org      http://www.FreeBSD.org     The Power to Serve
> jim at TheHousleys.Net  http://www.TheHousleys.net
> ---------------------------------------------------------------------
> Your mouse has moved.
> Windows NT must be restarted for the change to take effect!
> 
> Reboot now?  [OK]
>