firewall design

i aspire to design a content based packet filter (in a router)in this
manner:-
* disable the routing function.
* use tcpdump to monitor and capture packets on incoming
interface.
* parse the packet content till application layer content and
check if it matches with the filtering criteria.
* if not inject the packet in the outgoing interface by hacking
the kernel network testing machanism("Packet Generator" of linux
2.4)to generate a copy of the packet.
i need suggestions on this strategy.

Sridhar Natarajan wrote:
> i aspire to design a content based packet filter (in a router)in this
> manner:-
> * disable the routing function.
> * use tcpdump to monitor and capture packets on incoming
> interface.
> * parse the packet content till application layer content and
> check if it matches with the filtering criteria.
> * if not inject the packet in the outgoing interface by hacking
> the kernel network testing machanism("Packet Generator" of linux
> 2.4)to generate a copy of the packet.
> i need suggestions on this strategy.

Don't.

There is a good way to get packets into and out of
the network stack at the driver level: the tun/tap
device driver. Have a look at it, so you do not
need to do a kludge into the network stack.

To use it, you have to enable packet forwarding.

The proper way to limit what is forwarded and where,
is using iptables.

--

Tauno Voipio
tauno voipio (at) iki fi

Sridhar Natarajan wrote:
> i aspire to design a content based packet filter (in a router)in this
> manner:-
> * disable the routing function.
> * use tcpdump to monitor and capture packets on incoming
> interface.
> * parse the packet content till application layer content and
> check if it matches with the filtering criteria.

You can use snort-inline to read the tcpdump files and very simple rules
to stop the traffic you want to.

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"