Describe the solution you'd like
Two new plugins:
- linux.iptables — walks the ipt_table / ip6t_table kernel structures via ISF to extract iptables/ip6tables rules, outputting per-rule match
expressions and targets (ACCEPT, DROP, REJECT, SNAT, DNAT, MASQUERADE, etc.) in a format similar to iptables-save.
- linux.iptables_nft — walks nf_tables kernel structures to extract rules loaded via nftables or the nft-backed iptables compatibility layer,
decoding native nft expressions (meta, payload, cmp, nat, log, limit, range) and xt_compat match extensions side-by-side.
Both plugins should output: network namespace, address family, table, chain, policy, rule number, match string, and target.
Describe alternatives you've considered
Running iptables-save or nft list ruleset on a live system is not viable in a forensic context. No existing Volatility3 plugin covers firewall
state.
Additional information
Both plugins have been implemented and tested against Debian 11 and ubuntu 20.04. memory images captured with avml. They handle
Docker-generated rules, IPv6, interface negation, conntrack state matching, and nftables-native expressions. Code is available for review.
Describe the solution you'd like
Two new plugins:
expressions and targets (ACCEPT, DROP, REJECT, SNAT, DNAT, MASQUERADE, etc.) in a format similar to iptables-save.
decoding native nft expressions (meta, payload, cmp, nat, log, limit, range) and xt_compat match extensions side-by-side.
Both plugins should output: network namespace, address family, table, chain, policy, rule number, match string, and target.
Describe alternatives you've considered
Running iptables-save or nft list ruleset on a live system is not viable in a forensic context. No existing Volatility3 plugin covers firewall
state.
Additional information
Both plugins have been implemented and tested against Debian 11 and ubuntu 20.04. memory images captured with avml. They handle
Docker-generated rules, IPv6, interface negation, conntrack state matching, and nftables-native expressions. Code is available for review.