[Solved] Packet filtering.

Question

Hi,
I am looking for a convenient way to filter packets from expression in form of \x00 (for exemple) I took a look at tcpdump but couldn't find a way to do so with it and it would actually be better if I could do so without using WireShark (for memory consumption). This is for a bash script and any hint would help, should I consider coding a packet filter in bash and then filter packets from my hexadecimal pattern ? Or is there another tool I could use to do do ?
Thank's a lot
Last edited by sugartest (2014-07-16 12:10:25)

Answer 1

You can do that with iptables using the 'string' module.
man iptables-extentions wrote:
   string
       This modules matches a given string by using some pattern matching strategy. It requires a linux kernel >= 2.6.14.
       --algo {bm|kmp}
              Select the pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
       --from offset
              Set the offset from which it starts looking for any matching. If not passed, default is 0.
       --to offset
              Set the offset up to which should be scanned. That is, byte offset-1 (counting from 0) is the last one that is scanned.  If not passed, default is the packet size.
       [!] --string pattern
              Matches the given pattern.
       [!] --hex-string pattern
              Matches the given pattern in hex notation.
       Examples:
              # The string pattern can be used for simple text characters.
              iptables -A INPUT -p tcp --dport 80 -m string --algo bm --string 'GET /index.html' -j LOG
              # The hex string pattern can be used for non-printable characters, like |0D 0A| or |0D0A|.
              iptables -p udp --dport 53 -m string --algo bm --from 40 --to 57 --hex-string '|03|www|09|netfilter|03|org|00|'