tcpdump -ni em0 «vlan and ip[40:4]=0x7FFFFFFF»
#!/bin/sh kldload ng_bpf kldload ng_tag kldload ng_ipfw /usr/sbin/ngctl -f- < <-SEQ mkpeer ipfw: bpf 61 ipfw_hook61 name ipfw:61 bpf_utp_filter mkpeer bpf_utp_filter: tag matched tag_utp name bpf_utp_filter:matched tag_utp_tagger SEQ ngctl msg bpf_utp_filter: setprogram { thisHook=\"ipfw_hook61\" ifNotMatch=\"ipfw_hook61\" ifMatch=\"matched\" bpf_prog_len=12 bpf_prog=[ { code=48 jt=0 jf=0 k=0 } { code=84 jt=0 jf=0 k=240 } { code=21 jt=0 jf=8 k=64 } { code=48 jt=0 jf=0 k=9 } { code=21 jt=0 jf=6 k=17 } { code=40 jt=0 jf=0 k=6 } { code=69 jt=4 jf=0 k=8191 } { code=177 jt=0 jf=0 k=0 } { code=64 jt=0 jf=0 k=20 } { code=21 jt=0 jf=1 k=2147483647 } { code=6 jt=0 jf=0 k=65535 } { code=6 jt=0 jf=0 k=0 } ] } ngctl msg bpf_utp_filter: setprogram { thisHook=\"matched\" ifMatch=\"ipfw_hook61\" bpf_prog_len=1 bpf_prog=[ { code=6 jt=0 jf=0 k=96 } ] } ngctl msg tag_utp_tagger: sethookin { thisHook=\"tag_utp\" ifNotMatch=\"tag_utp\" } ngctl msg tag_utp_tagger: sethookout { thisHook=\"tag_utp\" tag_cookie=1148380143 tag_id=61 } ipfw add netgraph 61 udp from any to any iplen 0-61 ipfw add deny udp from any to any tagged 0-61 # to test outgoing - tcpdump -pni Out_Interface "ip[40:4]=0x7FFFFFFF" and "ip[44:1]=0xab" and ether src Ext_If_Mac |
С новыми сигнатурами 2.01
#!/bin/sh kldload ng_bpf kldload ng_tag kldload ng_ipfw /usr/sbin/ngctl -f- < <-SEQ mkpeer ipfw: bpf 61 ipfw_hook61 name ipfw:61 bpf_utp_filter mkpeer bpf_utp_filter: tag matched tag_utp name bpf_utp_filter:matched tag_utp_tagger SEQ ngctl msg bpf_utp_filter: setprogram { thisHook=\"ipfw_hook61\" ifNotMatch=\"ipfw_hook61\" ifMatch=\"matched\" bpf_prog_len=13 bpf_prog=[ { code=48 jt=0 jf=0 k=0 } { code=84 jt=0 jf=0 k=240 } { code=21 jt=0 jf=9 k=64 } { code=32 jt=0 jf=0 k=36 } { code=21 jt=0 jf=2 k=2147483647 } { code=40 jt=0 jf=0 k=40 } { code=21 jt=4 jf=0 k=3 } { code=32 jt=0 jf=0 k=40 } { code=21 jt=0 jf=3 k=2147483647 } { code=48 jt=0 jf=0 k=44 } { code=21 jt=0 jf=1 k=171 } { code=6 jt=0 jf=0 k=65535 } { code=6 jt=0 jf=0 k=0 } ] } ngctl msg bpf_utp_filter: setprogram { thisHook=\"matched\" ifMatch=\"ipfw_hook61\" bpf_prog_len=1 bpf_prog=[ { code=6 jt=0 jf=0 k=96 } ] } ngctl msg tag_utp_tagger: sethookin { thisHook=\"tag_utp\" ifNotMatch=\"tag_utp\" } ngctl msg tag_utp_tagger: sethookout { thisHook=\"tag_utp\" tag_cookie=1148380143 tag_id=61 } ipfw add netgraph 61 udp from any to any iplen 48-61 ipfw add deny udp from any to any tagged 61 # to test outgoing - tcpdump -pni ext0 '(ip[36:4]=0x7FFFFFFF and ip[40:2]=0x0003) or (ip[40:4]=0x7FFFFFFF and ip[44:1]=0xab)' and ether src Ext_If_Mac |
P.S. А вот так это делается в linux-е.
/sbin/iptables -A FORWARD -m udp -p udp -m string --hex-string "|0000000000380000|" --algo bm --from 36 --to 45 -j DROP /sbin/iptables -A FORWARD -m udp -p udp -m string --hex-string "|7F FF FF FF AB|" --algo bm --from 40 --to 44 -j DROP /sbin/iptables -A FORWARD -m udp -p udp -m string --hex-string "|7F FF FF FF 00 03 20 00|" --algo bm --from 36 --to 43 -j DROP /sbin/iptables -A FORWARD -m udp -p udp -m string --hex-string "|00 38 00 00 00 01 00 00|" --algo bm --from 40 --to 47 -j DROP |