Use Scapy as IPS for intercepting, selecting and forwarding packets

Question

I need to intercept network traffic (IPS mode) and drop selected packets, accordingly to specific needs.
I've got two ethernet NIC eth0 and eth1 in promiscuous mode, and I need to retrieve packets from eth0, drop some packets accordingly to specific rules, and forward selected packets to ethic.
I know that IPS systems such as Snort allows to intercept and filter packets, but I'd prefer to do that using a Python program, using Scapy library, if possible.
How can I intercept and forward network traffic using two NIC in promiscuous mode with Scapy?

Answer 1

You cannot "intercept" packets from Scapy.

When Snort do that, it stops being an IDS (that sniffs the network) and becomes an IPS (basically, a firewall that looks at the application layer as well as the network layers to make its decisions).

To do what you want, you'll need Netfilter, the NFQUEUE target of Iptables and the Python bindings for nfqueue (python-nfqueue package under Debian based distributions).

Scapy may only help you to dissect the packets (to "understand" them and optionally tamper them).

Anyway, this is probably going to be very slow, so unless you are working on a PoC, you probably want to use Snort or Suricata.