netdev - Re: [RFC 0/1] Appletalk AARP probe broken by receipt of own broadcasts.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180819144107.GA23981@lunn.ch>
Date:   Sun, 19 Aug 2018 16:41:07 +0200
From:   Andrew Lunn <andrew@...n.ch>
To:     Craig McGeachie <slapdau@...il.com>
Cc:     "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        Craig McGeachie <slapdau@...oo.com.au>
Subject: Re: [RFC 0/1] Appletalk AARP probe broken by receipt of own
 broadcasts.

> I run inside Virtualbox with the Realtek PCIe GBE Family Controller.
> 
> Assuming I'm reading /sys/class/net/enp0s3/driver correctly, it's using the
> e1000 driver.

Hi Craig

Ah. And how do you connect to the network? Please run some tcpdumps
and collect packets at various points. Make sure your network setup is
not duplicating packets, in particular, any bridges you might have in
order to connect the segments together.

> However, it might not be the ethernet driver's fault. I've been a bit loose
> with terminology. Appletalk AARP probe packets aren't ethernet broadcasts as
> such; they're multicast packets, via the psnap driver, to hardware address
> 09:00:07:ff:ff:ff.

Basically, the same question applies for Multicast as for Broadcast.
I'm pretty sure the interface should not receiver the packet it
transmitted itself. But if something on the network has duplicated the
packet, it will receiver the duplicate. So before we add a filter,
lets understand where the packets are coming from.

	Andrew