Ptrace and filter question

Charles Scott (cscott@freeway.net)
Sat, 28 Dec 1996 17:09:41 -0500 (EST)

Question...

Let's say I have a filter which specifically prohibits something. For
example, I have a filter which specifically prohibits netbios over ip by
blocking tcp and udp to and from ports 137, 138 and 139. Radius assigns
this filter to users as they connect and they show up using "sh sX" for
ifilter and ofilter (so I know they're being assigned). Then I use ptrace
with a filter that specifically allows only those packets. Should I
expect ptrace to display those packets even though they are supposedly
being filtered at each port or should I not see them with ptrace because
they have been filtered at the user's port? In short, can I do this to
test if my filters are working correctly?

Chuck