Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

It is said that kernel responsible for the transport, internet and network access layers for a network data. Then, the network data is passed on the appropriate process based on port number.

How security programs like firewall, IPS and IDS have access to network data that do not belong them while they are just user level program and not part of kernel? How about proxy server?

How come the network data has to pass the firewall first before the appropriate process?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Generally, those security programs contain two parts, one running in kernel space, one running in user space. The user space part is only an interface to iteract with kernel space part.

For example, iptables contains:

  • netfilter, a set of hooks to the networking code in the kernel. It also includes mechanisms for passing packets to user space program.

  • ip_tables, a module that uses netfilter to troubleshoot the network packets, set up rules...

  • iptables, a user space tool for setting up rules in the ip_tables module.

Netfilter and ip_iptables run in kernel space while iptables run in user space.

share|improve this answer
    
I do have experience with iptables and have read about Netfilter on Wikipedia but it is still unclear to me. How the security programs (process) receive the network data that are not supposed for them? –  Ron Vince Apr 2 at 5:48
    
I think you should read through the netfiilter documentation or source and try to understand how it work, or how netfilter hook into the kernel. –  cuonglm Apr 2 at 5:56
    
It seems like netfilter is for Linux kernel. How about FreeBSD? –  Ron Vince Apr 2 at 8:42
    
I haven't used FreeBSD yet, but google give me: freebsd.org/doc/en/articles/linux-users/firewall.html –  cuonglm Apr 2 at 8:45
    
Somehow I missed to mention something in the previous answer. How netfilter is connected to transport layer, internet layer and network access layer in kernel? How is it connected to application layer? netfilter is for Linux kernel. Somehow I have not found relevant documents. How about FreeBSD? –  Ron Vince Apr 2 at 9:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.