Using netgraph for filtering/modifing packets

Julian Elischer julian at
Mon Jun 14 17:35:56 GMT 2004

On Mon, 14 Jun 2004, James Housley wrote:

> For testing of a product I would like to be able to modify or even drop
> packets based on their content.  What I have in mind is forcing the
> packets through a firewall that would redirect all packet to a netgraph
> node that would either pass unchanged, drop or change the contents to
> assist in testing some corner cases in the code.
> 1) is this something doable with netgraph, I believe it is.


> 2) what might be a good place to start?  Have done some searching, but
> haven't found any example code I thought I could start from.

What sort of filter do you need?

you can pass packets to netgraph from ipfw by diverting them and
openning a divert socket with teh ksocket node..

Or you can pick them directly from the network interface
and filter yourself using the 'bpf' node type to select 
on something.
or you can use the etf type of node to filter on a particular 

there are a lot of options but I don't knw your application enough :-)


> Thanks,
> Jim
> -- 
> /"\   ASCII Ribbon Campaign  .
> \ / - NO HTML/RTF in e-mail  .
>    X  - NO Word docs in e-mail .
> / \ -----------------------------------------------------------------
> jeh at     The Power to Serve
> jim at TheHousleys.Net
> ---------------------------------------------------------------------
> Your mouse has moved.
> Windows NT must be restarted for the change to take effect!
> Reboot now?  [OK]

More information about the freebsd-net mailing list