Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am curious if most Linux distros make it possible to intercept incoming network traffic as soon as it enters the system and filter its content based on some rules before any other client can use it or at least before it gets to a specified client.

E.g., let's say I wanted to have a filter that intercepts all HTTP traffic before it gets to a specific client (e.g. Firefox) and, if some pattern is matched, modify the HTML. Or replace all content coming from a certain remote host. I would like to be able to do that before it hits any client, regardless of the client.

Does Linux allow for that kind of packet filtering?

Additionally, I would also like to know what the workflow of a network packet is once it enters the computer from the port, i.e. if there is a sequence of steps assigned that gets performed before it becomes available to the client app that invoked it.

share|improve this question
You can shunt traffic to userspace using tun/tap devices, and probably several other ways. And you can actually use firewall rules to make routing decisions. Also, see NFQUEUE – derobert Mar 22 '13 at 22:03
up vote 4 down vote accepted

You need to Content-filtering not Packet-filtering .

Packet filtering : Working on Port, IP, layers , redirecting , icmp, udp, and other necessary protocol.

Content Filtering: Suppose you have a packet and it have a payload such as sex term.you need to drop it.

Content filtering softwares: Dansguardian , SquidGuard, HostsFile, OpenDNS, FoxFilter (FireFox extension) , webcleaner .

share|improve this answer
so with FoxFilter, can i enter a rule to remove a certain DOM section of HTML from a certain domain ? or if word X comes in in the HTML from doman Y, replace it in the HTML stream automatucally with abc? – amphibient Mar 22 '13 at 22:08
yes, it's possible. – PersianGulf Mar 22 '13 at 22:15

I am partial to IPtables for work and home. You can filter or redirect incoming or outgoing traffic, log a subset of everything, and I think you can run scripts or programs on the packets but I have not attempted it.

I keep a copy in my ifup folder and save it on ifdown to filter traffic by country and content. The filters are arbitrarily complex

You may want to look at rule #6 at http://www.thegeekstuff.com/2011/06/iptables-rules-examples/ to start.

share|improve this answer

You can do exactly this with ettercap which is a soft for network analysts, penetration testers, and kinda script kiddies.

I myself look for what kind of packet could be "sent" to firefox and how.

PS: french native, excuse my bad english

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.