How to mark all packets (inbound and outbound) for specific program/ cmd in Linux using iptables or any other firewall/ tool

Given that --cmd-owner option was deprecated ref:http://www.spinics.net/lists/netfilter/msg49716.html.

For example, how to mark all Firefox's packets, knowing that Firefox can spawn processes so the PID option isn't feasible.

1 Answer 1


A possible solution using cgroups net_cls subsystem to group certain processes group, mark the packets in this cgroup using the iptables rule with the match extension, and then use tcpdump to monitor the packets from this cgroup. by listening to an nflog interface.


Creating a cgroup in the net_cls subsystem

$ mkdir /sys/fs/cgroup/net_cls/firefox

Add the relevant pid to the cgroup

The best way, to ensure that all related pids are grouped, is to do so before you start running the application.

For instance, if you want to run firefox, first check the pid of your current shell (echo $$). Then add it to the cgroup you created.

$ echo <pid> > /sys/fs/cgroup/net_cls/firefox/tasks

All the process spawning from your shell will now be assigend to the "firefox" cgroup.

Assigning a class id to the cgroup

From the documentation of the cgroups net_cls:

You can write hexadecimal values to net_cls.classid; the format for these values is 0xAAAABBBB; AAAA is the major handle number and BBBB is the minor handle number.

echo 0x100001 > /sys/fs/cgroup/net_cls/firefox/net_cls.classid

Mark those packets in an iptables rule

iptables has match extensions that you can leverage:


iptables can use extended packet matching modules with the -m or --match options, followed by the matching module name; after these, various extra command line options become available, depending on the specific module.

You use the cgroup extension module, and mark those packets by assigning the NFLOG as a group target:


This target provides logging of matching packets. When this target is set for a rule, the Linux kernel will pass the packet to the loaded logging backend to log the packet. This is usually used in combination with nfnetlink_log as logging backend, which will multicast the packet through a netlink socket to the specified multicast group. One or more userspace processes may subscribe to the group to receive the packets.

--nflog-group nlgroup

The netlink group (0 - 2^16-1) to which packets are (only applicable for nfnetlink_log). The default value is 0.

So it would look something like (take the net_cls.classid you created, and decide of some number to the nflog group):

$ iptables -I INPUT 1 -m cgroup --cgroup 0x100001 -j NFLOG --nflog-group 123
$ iptables -I OUTPUT 1 -m cgroup --cgroup 0x100001 -j NFLOG --nflog-group 123

This rule would mark all the incoming/outgoing packets in the cgroup with a nflog group number 123.

Run tcpdump

You can use the nflog interface. Not all versions of tcpdump support this. You can check if your versions does:

$ tcpdump --list-interfaces |grep nflog
5.nflog (Linux netfilter log (NFLOG) interface) [none]

If it does, you can listen to all the packets in this interfaces, which are the packets sent/received by the processes in the cgroup you created:

$ tcpdump -v -i nflog:123
  • Thanks for the answer! isn't this approach marking only packets originating from my device (outbound)? Is there a way to mark inbound packets, it seems like there must be a way since the destination of that packet is a local socket and we can get the program name (or PID) that has created it with ss command.
    – user216385
    Apr 20, 2023 at 14:23
  • @user216385 It's marking both inbound and outbound packages. Notice there are two iptables commands - one to the INPUT chain and one to the OUTPUT chain.
    – aviro
    Apr 20, 2023 at 15:01
  • I've set up both iptables rules, but it's only recording outbound packets from the process, no inbound ones. The process is the PowerDNS recursor, and the traffic is just UDP port 53 traffic. Then I added the pid of DNSdist that the recursor is mainly getting packets from, but still no inbound packets are found! Most frustrating. Any ideas?
    – PFudd
    Jul 28, 2023 at 1:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .