Packet capturing, iptables and eth0 vs. dummy0

[DervishD <lkml@dervishd.net>]

    Hi all :)

    I've noticed that, no matter what filtering is iptables doing,
tcpdump gets all packets from interface eth0 as seen in the bus, but
doesn't do the same in dummy0. I'll explain it further...

    Let's say that I'm filtering all incoming TCP SYN packets on all
interfaces that have a destination port of 6666 (for example), and
I'm listening, with tcpdump, to all packets in eth0. Well, I use
another computer to try to connect to port 6666 of the machine
running tcpdump and the packet filter, and obviously I'm unable to
connect (without the filter I can do it normally), but I see the SYN
packets in the output of tcpdump.

    If I do exactly the same from the machine running tcpdump and the
filter, I cannot connect (without the filter I can), but no output
comes from tcpdump, which is exactly what I expected in the case
explained in the paragraph above.

    Is is normal? Is normal that tcpdump shows packets before they
enter the filter when the interface is a real one (eth0) but no when
you access through a dummy interface or localhost, or am I missing
anything?

    Thanks a lot in advance :)
    
    Raúl Núñez de Arenas Coronado

-- 
Linux Registered User 88736
http://www.dervishd.net & http://www.pleyades.net/