lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 18 Jan 2012 14:47:50 +0530
From:	"Prashant Batra (prbatra)" <>
To:	<>
Subject: route problem


I have added a route for an external ip via a gateway which is available
on the same machine.
I want to capture the packets going to this external IP using PF_PACKET

Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface   *        U     0      0        0
eth1   UG    0      0        0

So, when a packet is sent to 172.16.60.*, kernel should send arp request
for this gw IP As gw IP is locally reachable, 
It should send its mac address in arp-response and kernel should send
the packet via that interface.

But what I am seeing is that instead of asking the gateway IP, kernel
sends a arp request for destingation ip(172.16.60.*)

#tcpdump -I eth1
04:12:45.334966 arp who-has tell
04:12:46.334839 arp who-has tell
04:12:48.334584 arp who-has tell
04:12:49.334457 arp who-has tell
04:12:50.335329 arp who-has tell
04:12:52.335075 arp who-has tell
04:12:53.334947 arp who-has tell
04:12:54.334821 arp who-has tell

Is my understanding correct?


To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists