Home / server / Questions / 233302
Accepted
Pablo Santa Cruz
Asked: 2011-02-10 06:45:19 +0800 CST

Will tcpdump see packets that are being dropped by iptables?

  • 772

I have a firewall with these simple rules:

iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT
iptables -A INPUT -p tcp --dport 6000 -j REJECT

Now, suppose I am using TCPDUMP like this:

tcpdump port 6000

And I have host 192.168.16.21 trying to connect to port 6000.

Will/should tcpdump output some packets coming from 192.168.16.21?

firewall tcpdump iptables tcp

1 Answers

  1. Best Answer

    tcpdump uses libpcap and libpcap processes packets before they get processed by the firewall, so the answer is "yes".

    • 34