I am curious if most Linux distros make it possible to intercept incoming network traffic as soon as it enters the system and filter its content based on some rules before any other client can use it or at least before it gets to a specified client.

E.g., let's say I wanted to have a filter that intercepts all HTTP traffic before it gets to a specific client (e.g. Firefox) and, if some pattern is matched, modify the HTML. Or replace all content coming from a certain remote host. I would like to be able to do that before it hits any client, regardless of the client.

Does Linux allow for that kind of packet filtering?

Additionally, I would also like to know what the workflow of a network packet is once it enters the computer from the port, i.e. if there is a sequence of steps assigned that gets performed before it becomes available to the client app that invoked it.

  • You can shunt traffic to userspace using tun/tap devices, and probably several other ways. And you can actually use firewall rules to make routing decisions. Also, see NFQUEUE – derobert Mar 22 '13 at 22:03

You need to Content-filtering not Packet-filtering .

Packet filtering : Working on Port, IP, layers , redirecting , icmp, udp, and other necessary protocol.

Content Filtering: Suppose you have a packet and it have a payload such as sex term.you need to drop it.

Content filtering softwares: Dansguardian , SquidGuard, HostsFile, OpenDNS, FoxFilter (FireFox extension) , webcleaner .

| improve this answer | |
  • so with FoxFilter, can i enter a rule to remove a certain DOM section of HTML from a certain domain ? or if word X comes in in the HTML from doman Y, replace it in the HTML stream automatucally with abc? – amphibient Mar 22 '13 at 22:08
  • yes, it's possible. – PersianGulf Mar 22 '13 at 22:15

I am partial to IPtables for work and home. You can filter or redirect incoming or outgoing traffic, log a subset of everything, and I think you can run scripts or programs on the packets but I have not attempted it.

I keep a copy in my ifup folder and save it on ifdown to filter traffic by country and content. The filters are arbitrarily complex

You may want to look at rule #6 at http://www.thegeekstuff.com/2011/06/iptables-rules-examples/ to start.

| improve this answer | |

You can do exactly this with ettercap which is a soft for network analysts, penetration testers, and kinda script kiddies.

I myself look for what kind of packet could be "sent" to firefox and how.

PS: french native, excuse my bad english

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.