How to implement filtering of TCP packets by content in the Data field under windows on the fly?

R

Roman2020-10-16 10:57:45

Windows

Roman, 2020-10-16 10:57:45

Good day to all!

Please tell me the solution to this problem:
it is necessary to filter TCP packets containing text messages on a Windows machine. Some are skipped, while others are discarded.
Messages are not encrypted.
Is it possible to implement this by means of the operating system itself?
Is it possible to implement this by third-party means (proxy server or some kind of filter driver)?

Package example:

Thank you for your answers.

Reply

Answer the question

In order to leave comments, you need to log in

6 answer(s)

X

xmoonlight, 2020-10-18
@Verdoga

https://github.com/ntkernelcom/ndisapi

I

Inviz Custos, 2020-10-16
@MvcBox

filter TCP packets containing text messages.

It is in this wording - it is impossible.
TCP has no concept of "packet" as such.
TCP is a conditionally infinite data stream in which data is transmitted in small "portions" in TCP segments. Your message can be sent in one segment or multiple segments with 1 payload byte each.
The received data is buffered by the application, and then (if there is enough data received) it is processed according to the protocol of this application.
Therefore, "stateless" checking the contents of the segment is useless.

Is it possible to implement this by third-party means (proxy server or some kind of filter driver)?

The easiest way is to implement a proxy server that will support the application protocol.
This way you can filter traffic for this application.

V

ValdikSS, 2020-10-16
@ValdikSS

Use WinDivert .

C

ComodoHacker, 2020-10-16
@ComodoHacker

Comodo seems to be able to do this. But not sure how it is now.

V

Vladimir, 2020-10-16
@MechanID

under Linux in Snort https://www.snort.org/ it was possible to build rules with the string criterion in ASCII,
since Snort is also available under Windows, this may solve your problem.
for more details about creating such rules - manual-snort-org.s3-website-us-east-1.amazonaws.co...

C

CityCat4, 2020-10-16
@CityCat4

The question is meaningless.
TCP does not contain text or non-text messages - it contains a payload that is parsed by upper layer protocols. This payload, as Inviz Custos rightly noted, can be 1 byte per TCP packet, which can be a zillion - and the kernel must collect all of them into one common buffer before sending it "up".
Filtering what came to the payload must be done on ISO / OSI 7 - after all assemblies, decryptions, etc.