Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For my application, I need to intercept certain TCP/IP packets and route them to a different device over a custom communications link (not Ethernet). I need all the TCP control packets and the full headers. I have figured out how to obtain these using a raw socket using socket(PF_PACKET, SOCK_RAW, htons(ETH_P_IP). This works well and allows me to attach filters to just see the TCP port I'm interested in.

However, Linux also sees these packets. By default, it sends a RST when it receives a packet to a port number it doesn't know about. That's no good as I plan to send back a response myself later. If I open up a second "normal" socket on that same port using socket(PF_INET, SOCK_STREAM, 0) and listen() on it, Linux then sends ACK to incoming TCP packets. Neither of these options is what I want. I want it to do nothing with these packets so I can handle everything myself. How can I accomplish this?

share|improve this question
You can use iptables to block the packets from normal processing. – David Schwartz Jun 28 '13 at 8:30
up vote 1 down vote accepted


You can drop those packets at the OUTPUT chain of the FILTER table.

The protocol

RFC 793 (TCP) specifies the RST-sending behavior


  If the state is CLOSED (i.e., TCB does not exist) then [...]:
  An incoming segment not containing a RST causes a RST to be sent in response. 

And linux obiviously implements it correctly.

The sysctl interface

It seems the behaviour is also not tweakable through the sysctl interface (see tcp(7)). In any event, that man page is definitely a good read if you haven't already come across it yet.

Kernel code

Depending on what you actually want to acheive, altering the kernel code directly might be an option.

share|improve this answer
I will look into iptables. Could they also be used to stop those packets on the way in? It seems it would be better to keep the kernel from seeing that TCP traffic in the first place. – Jon Jun 28 '13 at 16:26
Yes of course. In this case it's the INPUT chain of the FILTER table – artistoex Jun 28 '13 at 18:31
My limited version of uClinux wasn't including iptables support, but I was able to add it. It is working great - just one call does the trick. Thanks. – Jon Jun 29 '13 at 4:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.