Before you start

About this tutorial

Information these days spends much of its time encapsulated in packets, flowing through pipes known as networks. In this tutorial, we will be capturing those packets as they flow, and the platform on which we will be capturing them is Linux.

Most network applications -- from Virtual Private Networks (VPNs) to routers to sniffers -- have some sort of packet capturing mechanism. So anyone involved with writing such software can benefit from this tutorial.

Because several of the packet filtering mechanisms we will examine are kernel modules, we will also briefly cover those, as well as kernel compilation.

We will also review some of the mechanisms that were unsuccessful for me: I could get only a copy of the packet instead of intercepting the original. This discussion can not only save you the trouble of duplicating my efforts, but can also be useful for network applications like sniffers.

Apart from a general familiarity with the different packet capturing mechanisms including firewall hooks, divert socket, and netfilter; readers will also gain knowledge about Linux networking and the TCP/IP stack. There is even some source code to get you started.

Back to top

Prerequisites

This tutorial is best suited to readers with some experience with system programming, Linux networking, and Linux kernel modules. However, this tutorial aims to keep concepts as simple as possible and to give detailed explanations where appropriate.

1 of 12 | Next

Comments

Back to top

Table of contents

• Before you start
• Introduction to packet capturing
• Linux loadable kernel module (LKM)
• Compiling the kernel
• Packet interception: Firewall hooks
• Packet interception: Netfilter
• Packet interception: Divert socket
• Packet interception: Kernel tampering
• Packet interception: Making copies of packets
• Summary of packet interception mechanisms
• Resources
• About the author

---

1 of 12 | Next

Next steps from IBM

WebSphere Portal can help your small and midsize business achieve better website security, along with faster time to value with easily deployable and customizable example Web sites.

---

• Try: Download a free trial version of IBM WebSphere Portal Express V6.1, which offers collaboration, document management, and secure Web content management.
• Article: This article provides an overview of the WebSphere Portal security architecture, including internet security, and secure connections between clients.
• Tutorial: This tutorial take you through the steps to develop and test your first portlet WebSphere Portal Test Environment.
• Demo: These demos show Web 2.0 features available today within WebSphere Portal, as well as several features planned for the future.
• Buy: IBM WebSphere Portal Express

Dig deeper into Linux on developerWorks

Try IBM PureSystems. No charge.

Experience today!

---

Get started with the cloud-based trial and pattern development kit.