Re: stopping the packets from getting to kernel

two ways you can do it:

don't configure the interface to have an IP, so it is IPless. then you can
create a virtual stack with libnet and pcap, responding to selective IP
destinations. this is basically what honeyd does, you use an IPless
interface  usualy. you'll also have to do handle the ARP replies yourself,
probably. use a second interface ...

if you need to use one interface with an IP address on it, firewall
packets that are coming in. then you can prevent the kernel stack from
seeing them and responding (with a SYN-ACK or a RST or whatever). you can
respond to them in userland, using libnet and pcap, all on one interface.
libdnet lets you manipulate firewall rules from C code, as well, if you
want to add more code, or you can do it manually.

hope this helps,

________
jose nazario, ph.d.			[email protected]
http://monkey.org/~jose/ 		http://infosecdaily.net/