Re: how to sniff marked packets by iptables

Subject: Re: how to sniff marked packets by iptables

From: "Lucas Mocellin" <lucasmocellin@gmail.com>

Date: Thu, 25 Sep 2008 16:12:59 -0300

Message-id: <[🔎] edfc67860809251212v28ce7e57pa4ed9916713fbc2b@mail.gmail.com>

In-reply-to: <7afffa060809251200td962161jfead4eeb0b2f4cde@mail.gmail.com>

References: <[🔎] edfc67860809251057w5f801bd3j8b63cbc028803552@mail.gmail.com> <7afffa060809251200td962161jfead4eeb0b2f4cde@mail.gmail.com>

Yes, ethereal doesn't work too.

well, I think this is true, but must be something to sniff this "marks"

thanks,

Lucas.

2008/9/25 Brian Schrock <schrock.brian@gmail.com>

I was never under the impression that marking packets does anything to the packet itself. It only makes modifications to the struct that represents the packet in the kernel. Tcpdump only looks at the packet, therefore mark'ing a packet does nothing to the packet that the network would ever see. Internal only.

On Thu, Sep 25, 2008 at 1:57 PM, Lucas Mocellin <lucasmocellin@gmail.com> wrote:

Hi,

I marked some packets with iptables (-j MARK), and I want to "see" this set.

I tried to search google, but nothing related. tcpdump doesn't seems help with that.

Have anyone any idea?

Thanks,

Lucas Mocellin.

Reply to:

References:

how to sniff marked packets by iptables
- From: "Lucas Mocellin" <lucasmocellin@gmail.com>