topic Re: In which layer is my module? in Operating System - Linux

In which layer is my module?

oiram — Fri, 17 Jan 2003 10:55:02 GMT

Hello:

I have a third party application running in my redhat 7.2. This install a kernel module and we want to know in which layer this module listen for incoming packtes. tcpdump doesn??t work for us as it listen on layer 2.

Regards,
Mario.

Re: In which layer is my module?

Jerome Henry — Fri, 17 Jan 2003 12:16:54 GMT

Seems to me that it depens on what this application does !
Usually, talking about pure OSI layers, application is layer seven.
Then according to this application's usage, it'll send information to other layers that can be implemented in this program.
But what does it do ?
J

Re: In which layer is my module?

oiram — Fri, 17 Jan 2003 13:07:40 GMT

Hello:

It??s a proxy application and this module forbid any access to the system except to the ports specifically allowed.

Regards,
Mario.

Re: In which layer is my module?

Jerome Henry — Fri, 17 Jan 2003 14:10:40 GMT

Well,
supposely a proxy application works on layer 3.
Some proxy, though, also work on other layers (application proxies), which filter for example sql code injected in your machine, which would bring activity on layer 6.
tcpdump works on layer 2, but so it gets whatever would get into your machine.
Do you just need to know which layer is concerned, or do you need to monitor its activity, for which you could set up on realtime logging I suppose, or use a gui tool (there are many) ?

Re: In which layer is my module?

oiram — Fri, 17 Jan 2003 14:24:12 GMT

Hello:

We are waiting a DOS attack and we need to know in which layer gets the packets the application. The measures should be different if the module is working between layer 2 and 3 or between layer 3 and 4.

Thanks,
Mario.

Re: In which layer is my module?

Jerome Henry — Fri, 17 Jan 2003 17:22:12 GMT

I do not know which proxy product you are using, but a proxy is set to control connections, that is to say layer 3 and 2 (if it takes into consideration stuff such as attacker mac address), it is not set to control transport layer (if it is a stuff like netfilter/iptables).
Good luck.