Hi all :)
I've noticed that, no matter what filtering is iptables doing,
tcpdump gets all packets from interface eth0 as seen in the bus, but
doesn't do the same in dummy0. I'll explain it further...
Let's say that I'm filtering all incoming TCP SYN packets on all
interfaces that have a destination port of 6666 (for example), and
I'm listening, with tcpdump, to all packets in eth0. Well, I use
another computer to try to connect to port 6666 of the machine
running tcpdump and the packet filter, and obviously I'm unable to
connect (without the filter I can do it normally), but I see the SYN
packets in the output of tcpdump.
If I do exactly the same from the machine running tcpdump and the
filter, I cannot connect (without the filter I can), but no output
comes from tcpdump, which is exactly what I expected in the case
explained in the paragraph above.
Is is normal? Is normal that tcpdump shows packets before they
enter the filter when the interface is a real one (eth0) but no when
you access through a dummy interface or localhost, or am I missing
anything?
Thanks a lot in advance :)
Ra?l N??ez de Arenas Coronado
--
Linux Registered User 88736
http://www.dervishd.net & http://www.pleyades.net/
On Wed, Nov 17, 2004 at 09:30:33PM +0100, DervishD wrote:
> Hi all :)
Hi!
please send netfilter/iptables related questions to the respective
lists:
[email protected] (for user questions)
[email protected] (for development issues)
> I've noticed that, no matter what filtering is iptables doing,
> tcpdump gets all packets from interface eth0 as seen in the bus,
This is correct. iptables is a IPv4 packet filter. It is part of the
IPv4 stack. tcpdump uses PF_PACKET which attaches right above the
NIC driver, therefore you capture packets way before they enter the IPv4
stack.
> Ra?l N??ez de Arenas Coronado
--
- Harald Welte <[email protected]> http://www.gnumonks.org/
============================================================================
Programming is like sex: One mistake and you have to support it your lifetime
On Wed, 2004-11-17 at 21:30, DervishD wrote:
> Hi all :)
>
> I've noticed that, no matter what filtering is iptables doing,
> tcpdump gets all packets from interface eth0 as seen in the bus, but
> doesn't do the same in dummy0. I'll explain it further...
[snip]
> If I do exactly the same from the machine running tcpdump and the
> filter, I cannot connect (without the filter I can), but no output
> comes from tcpdump, which is exactly what I expected in the case
> explained in the paragraph above.
>
> Is is normal? Is normal that tcpdump shows packets before they
> enter the filter when the interface is a real one (eth0) but no when
> you access through a dummy interface or localhost, or am I missing
> anything?
Try sniffing on the 'lo' interface instead of 'dummy0' since all packets
generated by the local machine destined for the local machine goes via
the ?lo' interface. ipaddresses looks like they belong to interfaces but
that's not the case with linux, they belong to the machine.
'ip route list table local'
All packets destined for entries marked as "local" will go through the
'lo' interface.
--
/Martin
Hi Harald :)
* Harald Welte <[email protected]> dixit:
> On Wed, Nov 17, 2004 at 09:30:33PM +0100, DervishD wrote:
> please send netfilter/iptables related questions to the respective
> lists:
> [email protected] (for user questions)
> [email protected] (for development issues)
This time the iptables issue was just... collateral, so to say.
The problem was with tcpdump since I knew that packets were being
filtered.
> > I've noticed that, no matter what filtering is iptables doing,
> > tcpdump gets all packets from interface eth0 as seen in the bus,
> This is correct. iptables is a IPv4 packet filter. It is part of the
> IPv4 stack. tcpdump uses PF_PACKET which attaches right above the
> NIC driver, therefore you capture packets way before they enter the IPv4
> stack.
OK, I didn't see the problem from that perspective. Anyway, using
'lo' instead of 'dummy' solved the problem :)
Thanks for the help :)
Ra?l N??ez de Arenas Coronado
--
Linux Registered User 88736
http://www.dervishd.net & http://www.pleyades.net/
Hi Martin :)
* Martin Josefsson <[email protected]> dixit:
> > Is is normal? Is normal that tcpdump shows packets before they
> > enter the filter when the interface is a real one (eth0) but no when
> > you access through a dummy interface or localhost, or am I missing
> > anything?
> Try sniffing on the 'lo' interface instead of 'dummy0' since all packets
> generated by the local machine destined for the local machine goes via
> the ?lo' interface. ipaddresses looks like they belong to interfaces but
> that's not the case with linux, they belong to the machine.
That seemed to be the problem, thanks :)))
Ra?l N??ez de Arenas Coronado
--
Linux Registered User 88736
http://www.dervishd.net & http://www.pleyades.net/
That's because when you try locally, you end up using lo0, not eth0.
On Wed, 17 Nov 2004 21:30:33 +0100, DervishD <[email protected]> wrote:
> Hi all :)
>
> I've noticed that, no matter what filtering is iptables doing,
> tcpdump gets all packets from interface eth0 as seen in the bus, but
> doesn't do the same in dummy0. I'll explain it further...
>
> Let's say that I'm filtering all incoming TCP SYN packets on all
> interfaces that have a destination port of 6666 (for example), and
> I'm listening, with tcpdump, to all packets in eth0. Well, I use
> another computer to try to connect to port 6666 of the machine
> running tcpdump and the packet filter, and obviously I'm unable to
> connect (without the filter I can do it normally), but I see the SYN
> packets in the output of tcpdump.
>
> If I do exactly the same from the machine running tcpdump and the
> filter, I cannot connect (without the filter I can), but no output
> comes from tcpdump, which is exactly what I expected in the case
> explained in the paragraph above.
>
> Is is normal? Is normal that tcpdump shows packets before they
> enter the filter when the interface is a real one (eth0) but no when
> you access through a dummy interface or localhost, or am I missing
> anything?
>
> Thanks a lot in advance :)
>
> Ra?l N??ez de Arenas Coronado
>
> --
> Linux Registered User 88736
> http://www.dervishd.net & http://www.pleyades.net/
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
--
Don Lafontaine
http://www.avsim.com/hangar/utils/freefd