Arch Linux

thatguy

Member

Registered: 2012-08-21

Posts: 2

Wireshark and iptables

Hi there,

Does wireshark read packets before they reach the kernel/iptables? I had iptables set up to block everything, yet wireshark continued to get up to several hundred packets per second, mostly ARP broadcast from the lan. I know the firewall was in effect because I couldn't browse the internet. I don't understand how wireshark sees the packets if they are dropped by the firewall.

fukawi2

Ex-Administratorino

From: .vic.au

Registered: 2007-09-28

Posts: 6,237

Website

Re: Wireshark and iptables

Does wireshark read packets before they reach the kernel/iptables?

Yes.

I had iptables set up to block everything, yet wireshark continued to get up to several hundred packets per second, mostly ARP broadcast from the lan.

Expected behaviour. Use filters in wireshark to filter out what you don't want (or filter in only what you do what).

I don't understand how wireshark sees the packets if they are dropped by the firewall.

Using libpcap, wireshark/tcpdump is able to hook into the network stack within the kernel before iptables (technically "netfilter" in the kernel), so it sees the traffic before iptables sees it and acts upon the traffic.

Last edited by fukawi2 (2012-08-27 00:18:27)

---

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl