Using Netfilter to modify the payload of an IP packet?

["Michael Ransburg" <michael.ransburg@gmail.com>]

Hi all,

I currently use the "winpkfilter" framework (www.ntkernel.com) on
Windows to discard parts of the payload of IP packets transparently to
the sender and receiver. I.e., I use the promiscious mode to
accomplish this on a computer B while the packets go from computer A
to computer C.

For this I need to:
1) Capture all ethernet frames which belong to a certain IP packet
2) Reassemble the payload of the IP packet from all the ethernet frame payloads
3) Remove parts of this payload according to my appliation
4) Update TCP/IP headers (length, checksums, ...)
5) Refragment the modified payload into ethernet frames
6) Send the ethernet frames to their original destination

As you can see, this is quite complex since the winpkfilter framework
is based on capturing ethernet frames.

I'm now investigating netfilter for the tasks outlined above and I
have two questions:

1) Can the actions described above be performed using a linux based
netfilter framework?

2) Will using the netfilter framework make my life easier, i.e., are
for example modifications of the payload based on IP level possible
(which would already take some complexity out of my appliation).

Any further hints / pointers which you can provide are highly appreciated.

Many thanks,
Michael
--
icq: 71772353 | skype: daneel1409 | msn: mike@unfolded.com