Question

I’m trying to make an application level firewall for Linux , but for now i could only tell stuff like ip address , port number.

Is it possible to know which program send the packet ? If i don’t need to place a kernel module.

Thanks !

Answer 1

Not at this time. The three cases:

• input paath: The socket lookup has not been done yet by the time xtables runs
• forward path: There obviously is no local socket
• (local) output path: Neither the process info nor the socket info is passed onto nf_queue, though there was a patch proposed but has not received much attention.