This document provides administrators and engineers guidance on securing Cisco firewall appliances, which increases the overall security of an end-to end architecture. The functions of network devices are structured around three planes: management, control, and data. This document is structured around security operations (best practices) and the three functional planes of a network. In addition, this document provides an overview of each included feature and references to related documentation. For the purposes of this document, all mentions of "Cisco firewall" refer explicitly to the Cisco ASA Adaptive Security Appliances, though the concepts may apply to other firewall and security devices.

This is a nice question.

As a matter of fact, tcpdump is the first software found after the wire (and the NIC, if you will) on the way IN, and the last one on the way OUT.

Wire -> NIC -> tcpdump -> netfilter/iptables

iptables -> tcpdump -> NIC -> Wire
Thus it sees all packets reaching your interface, and all packets leaving your interface. Since packets to port 53 do not get a reply, as seen by tcpdump, you have successfully verified that your iptables rules have been correctly configured.

EDIT

Perhaps I should add a few details. tcpdump is based on libpcap, a library which creates a packet socket. When a regular packet is received in the network stack, the kernel first checks to see whether there is a packet socket interested in the newly arrived packet and, if there is one, it forwards the packet to that packet socket. If the option ETH_P_ALL is chosen, then all protocols go thru the packet socket.

libpcap implements one such packet socket with the option activated, keeps a copy for its own use, and duplicates the packet back onto the network stack, where it is processed by the kernel in the usual way, including passing it first to netfilter, the kernel-space counterpart of iptables. Same thing, in reverse order (i.e., first netfilter then last the passage thru the packet socket), on the way out.

Is this prone to hacking? But of course. There are certainly proof-of-concept rootkits using libpcap to intercept communications destined to the rootkit before the firewall can lay its hand on them. But even this pales in comparison with the fact that a simple Google query unearths working code hiding traffic even from libpcap. Still, most professionals think the advantages vastly outweigh the disadvantages, in debugging network packet filters.

NAT64Check is a tool developed by the Internet Society in collaboration with Stichting IPv6 Nederland, Go6, SJM Steffann, Internetbureau Max and Simply Understand. This allows you to enter the URL of a particular website, and then run tests over IPv4, IPv6 and NAT64 in order to check whether the website is actually reachable in each case, whether identical web pages are returned, and whether all the resources such as images, stylesheets and scripts load correctly. It also compares responsiveness using the different protocols, therefore  allowing network and system administrators to easily identify anything is ‘broken’, to pinpoint where any non-IPv6 compatible elements need to be fixed.

I work for OETIKER+PARTNER AG a consultancy company based in Olten, Switzerland. We use OpenSource Software extensively in all our projects. So I made it a habit to open source code we write whenever possible. Below is a list of notable projects I have created or been involved with over the years.

La communauté FrameIP partage gratuitement ses documentations et codes source concernant le monde des réseaux TCPIP.

Visité par plus de 5000 personnes par jours, FrameIP.com nécessite un hébergement performant, une richesse des documentations et un entretient permanent.

Pour continuer à encore mieux partager, votre participation à la communauté sera la bienvenue.

Free IP address to ASN database
Downloadable, easy to parse, updated hourly.

 SixXS (Six Access) is a free, non-profit, non-cost service for Local Internet Registries (LIR's) and endusers. The main target is to create a common portal to help company engineers find their way with IPv6 networks deploying IPv6 to their customers in a rapid and controllable fashion. To reach these targets we are providing a whitelabel IPv6 Tunnel Broker and Ghost Route Hunter, an IPv6 route monitoring tool and various other services to help out where needed.

This is a list of data sources that may be useful to cyber security. We are documenting these sources as part of an ongoing project, Stucco.

 Cisco Services for IPS protects and enhances the effectiveness of the Cisco Intrusion Prevention System. Supported by the Cisco Global Security Intelligence organization, Cisco Services for IPS delivers continuously updated, comprehensive, and accurate detection technology to identify and block fast-moving and emerging threats.

Various Security Technical Implementation Guides