Wireshark – How to See Packets Dropped by Iptables

iptableskernelnetworkingwireshark

I recently installed my hard drive in a new computer and after some fiddling around I noticed my iptables rules were dropping DNS responses for some reason, turns out they were configured to allow stuff on eth0, but eth8 is used in this computer and everything was being dropped (not just DNS queires). Anyhow, I was using Wireshark concurrently to see if the DNS servers were responding to the queries and found out that they did. But I had just noticed iptables was dropping said packets. How come Wireshark can see the packets if they are being dropped?

enter image description here

Script used to generate the ruleset:

# Flush all rules
iptables -F
iptables -X

# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow incomming traffic from estabilished and related connections
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Policy: Allow outgoing, deny incoming and forwarding
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

Best Answer

Wireshark uses libpcap to fetch data from the NIC before it is handled by the OS. See the libpcap tutorial for an introduction to libpcap.

Related Question