netdev - RE: route problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 18 Jan 2012 11:15:23 +0100
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	"Prashant Batra (prbatra)" <prbatra@...co.com>
Cc:	netdev@...r.kernel.org
Subject: RE: route problem

Le mercredi 18 janvier 2012 à 15:38 +0530, Prashant Batra (prbatra) a
écrit :
> 2.6.18 kernel.
> 

Please dont top post on netdev mailing list

> -----Original Message-----
> From: Eric Dumazet [mailto:eric.dumazet@...il.com] 
> Sent: Wednesday, January 18, 2012 2:58 PM
> To: Prashant Batra (prbatra)
> Cc: netdev@...r.kernel.org
> Subject: Re: route problem
> 
> Le mercredi 18 janvier 2012 à 14:47 +0530, Prashant Batra (prbatra) a
> écrit :
> > Hi,
> > 
> > I have added a route for an external ip via a gateway which is available
> > on the same machine.
> > I want to capture the packets going to this external IP using PF_PACKET
> > socket.
> > 
> > #route 
> > Destination     Gateway         Genmask         Flags Metric Ref    Use
> > Iface
> > 192.168.101.0   *               255.255.255.0   U     0      0        0
> > eth1
> > 172.16.60.0     192.168.101.10  255.255.255.0   UG    0      0        0
> > eth1
> > 
> > So, when a packet is sent to 172.16.60.*, kernel should send arp request
> > for this gw IP 192.168.101.10. As gw IP is locally reachable, 
> > It should send its mac address in arp-response and kernel should send
> > the packet via that interface.
> > 
> > But what I am seeing is that instead of asking the gateway IP, kernel
> > sends a arp request for destingation ip(172.16.60.*)
> > 
> > #tcpdump -I eth1
> > 04:12:45.334966 arp who-has 172.16.60.2 tell 192.168.101.20
> > 04:12:46.334839 arp who-has 172.16.60.2 tell 192.168.101.20
> > 04:12:48.334584 arp who-has 172.16.60.2 tell 192.168.101.20
> > 04:12:49.334457 arp who-has 172.16.60.2 tell 192.168.101.20
> > 04:12:50.335329 arp who-has 172.16.60.2 tell 192.168.101.20
> > 04:12:52.335075 arp who-has 172.16.60.2 tell 192.168.101.20
> > 04:12:53.334947 arp who-has 172.16.60.2 tell 192.168.101.20
> > 04:12:54.334821 arp who-has 172.16.60.2 tell 192.168.101.20
> > 

This comes from another machine, since your eth1 addr is 192.168.101.10



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html