record contents of packets dropped in iptables

Question

I'm trying to find a way to record the entire contents of packets (possibly with tcpdump) that have been dropped according to rules in iptables.

At present, I have a rule to log these packets (with a log prefix), then follow this with a rule to drop them.

Is there a way to record the contents of those packets for review afterwards?

So, I'm looking for this:

1. A rule that logs the matching packet
2. A rule that passes the packet to a new target that records its contents (maybe QUEUE target?)
3. A rule that drops the packet

2 & 3 may even be combined.

My understanding is that tcpdump may not be able to do this as it examines packets before iptables and therefore will not record just the dropped packets.

Thanks.

Solution

The NFLOG target can be used for this purpose. Here is a very basic example:

# Drop traffic by default
iptables -P INPUT DROP

# add your whitelists here
# iptables -A INPUT ...

# Pass the packets to NFLOG (just like LOG, but instead of syslog,
# it uses netlink). You can add extra filters such as '-p tcp' as usual
iptables -A INPUT -j NFLOG
# packets that get here will now be dropped per INPUT policy

# Finally you can use tcpdump to capture from this interface (there
# can only be one active user of nflog AFAIK)
tcpdump -i nflog ...

Refer to the iptables-extensions manual page for a description of the NFLOG target.