netdev - Re: route problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 18 Jan 2012 20:29:09 -0500
From:	Bill Fink <billfink@...dspring.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	"Prashant Batra (prbatra)" <prbatra@...co.com>,
	netdev@...r.kernel.org
Subject: Re: route problem

On Wed, 18 Jan 2012, Eric Dumazet wrote:

> Le mercredi 18 janvier 2012 à 15:38 +0530, Prashant Batra (prbatra) a
> écrit :
> > 2.6.18 kernel.
> > 
> 
> Please dont top post on netdev mailing list
> 
> > -----Original Message-----
> > From: Eric Dumazet [mailto:eric.dumazet@...il.com] 
> > Sent: Wednesday, January 18, 2012 2:58 PM
> > To: Prashant Batra (prbatra)
> > Cc: netdev@...r.kernel.org
> > Subject: Re: route problem
> > 
> > Le mercredi 18 janvier 2012 à 14:47 +0530, Prashant Batra (prbatra) a
> > écrit :
> > > Hi,
> > > 
> > > I have added a route for an external ip via a gateway which is available
> > > on the same machine.
> > > I want to capture the packets going to this external IP using PF_PACKET
> > > socket.
> > > 
> > > #route 
> > > Destination     Gateway         Genmask         Flags Metric Ref    Use
> > > Iface
> > > 192.168.101.0   *               255.255.255.0   U     0      0        0
> > > eth1
> > > 172.16.60.0     192.168.101.10  255.255.255.0   UG    0      0        0
> > > eth1
> > > 
> > > So, when a packet is sent to 172.16.60.*, kernel should send arp request
> > > for this gw IP 192.168.101.10. As gw IP is locally reachable, 
> > > It should send its mac address in arp-response and kernel should send
> > > the packet via that interface.
> > > 
> > > But what I am seeing is that instead of asking the gateway IP, kernel
> > > sends a arp request for destingation ip(172.16.60.*)
> > > 
> > > #tcpdump -I eth1
> > > 04:12:45.334966 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:46.334839 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:48.334584 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:49.334457 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:50.335329 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:52.335075 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:53.334947 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:54.334821 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 
> 
> This comes from another machine, since your eth1 addr is 192.168.101.10

Actually, if I'm interpreting the "ip route list cache" output
correctly, it appears it has local IP addresses of both 192.168.101.10
and 192.168.101.20.

> local 192.168.101.10 from 192.168.101.101 dev lo  src 192.168.101.10 
>     cache <local,src-direct>  iif eth1

> local 192.168.101.20 from 192.168.101.101 dev lo  src 192.168.101.20 
>     cache <local,src-direct>  iif eth1

And since his gateway is 192.168.101.10, an apparently local
IP address, that would probably explain the direct ARPS for
172.16.60.*.

						-Bill
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html