Have Geek Brain

Does libpcap get a copy of the package?

Does libpcap get a copy of the package or the actual package?

By copy, I mean: an application using libpcap receives package A, and the kernel also receives package A.

In fact, what I mean is, only an application using libpcap gets package A, but the kernel doesn't.

+2


a source to share


2 answers


libpcap

won't let you do what you want. The purpose of pcap is to transparently obtain a copy of every packet on the system.



You should investigate how to interact with the existing firewall on your system, or how to add your own filters to the netfilter system (on Linux).

+3


a source


The kernel will receive the packet, then pass it through a list of filters (for example, usually a filter for IPsec, firewall, etc.), and once it passes through all those filters, it passes the packet to the application. libpcap is another filter, but it just adds the package to the internal database for processing, instead of checking the package, modifying, or whatever other filters will do.



For what you want to do, the simplest solution would be to use a firewall.

+3


a source






More articles:


All Articles