Mailing List Archive: debugging transparent proxy with tcpdump

Hello,

On Fri, 16 Mar 2001, Joseph Mack wrote:

> I'm looking at packets after they've been accepted by TP
> and I'm using (among other things) tcpdump.
>
> Where in the netfilter chain does tcpdump look at incoming
> and outgoing packets? When they are put on/received from
> the wire? After the INPUT, before the OUTPUT chain...?

Before/after any netfilter chains. Such programs hook at
packet level before/after the IP stack just before/after the packet
is received/must be sent from/by the device. They work and for
other protocols. The tcpdump is a packet receiver just like the
IP stack is such one in the network stack.

> Anyone know?
>
> Thanks Joe

Regards

--
Julian Anastasov <ja@ssi.bg>