Packet capturing, iptables and eth0 vs. dummy0

Packet capturing, iptables and eth0 vs. dummy0

[DervishD]

    Hi all :)

    I've noticed that, no matter what filtering is iptables doing,
tcpdump gets all packets from interface eth0 as seen in the bus, but
doesn't do the same in dummy0. I'll explain it further...

    Let's say that I'm filtering all incoming TCP SYN packets on all
interfaces that have a destination port of 6666 (for example), and
I'm listening, with tcpdump, to all packets in eth0. Well, I use
another computer to try to connect to port 6666 of the machine
running tcpdump and the packet filter, and obviously I'm unable to
connect (without the filter I can do it normally), but I see the SYN
packets in the output of tcpdump.

    If I do exactly the same from the machine running tcpdump and the
filter, I cannot connect (without the filter I can), but no output
comes from tcpdump, which is exactly what I expected in the case
explained in the paragraph above.

    Is is normal? Is normal that tcpdump shows packets before they
enter the filter when the interface is a real one (eth0) but no when
you access through a dummy interface or localhost, or am I missing
anything?

    Thanks a lot in advance :)
    
    Raúl Núñez de Arenas Coronado

-- 
Linux Registered User 88736
http://www.dervishd.net & http://www.pleyades.net/

Re: Packet capturing, iptables and eth0 vs. dummy0

[Don Lafontaine]

That's because when you try locally, you end up using lo0, not eth0.


On Wed, 17 Nov 2004 21:30:33 +0100, DervishD <lkml@dervishd.net> wrote:
>    Hi all :)
> 
>    I've noticed that, no matter what filtering is iptables doing,
> tcpdump gets all packets from interface eth0 as seen in the bus, but
> doesn't do the same in dummy0. I'll explain it further...
> 
>    Let's say that I'm filtering all incoming TCP SYN packets on all
> interfaces that have a destination port of 6666 (for example), and
> I'm listening, with tcpdump, to all packets in eth0. Well, I use
> another computer to try to connect to port 6666 of the machine
> running tcpdump and the packet filter, and obviously I'm unable to
> connect (without the filter I can do it normally), but I see the SYN
> packets in the output of tcpdump.
> 
>    If I do exactly the same from the machine running tcpdump and the
> filter, I cannot connect (without the filter I can), but no output
> comes from tcpdump, which is exactly what I expected in the case
> explained in the paragraph above.
> 
>    Is is normal? Is normal that tcpdump shows packets before they
> enter the filter when the interface is a real one (eth0) but no when
> you access through a dummy interface or localhost, or am I missing
> anything?
> 
>    Thanks a lot in advance :)
> 
>    Raúl Núñez de Arenas Coronado
> 
> --
> Linux Registered User 88736
> http://www.dervishd.net & http://www.pleyades.net/
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 


-- 
Don Lafontaine
http://www.avsim.com/hangar/utils/freefd

Re: Packet capturing, iptables and eth0 vs. dummy0

[Martin Josefsson]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

On Wed, 2004-11-17 at 21:30, DervishD wrote:
>     Hi all :)
> 
>     I've noticed that, no matter what filtering is iptables doing,
> tcpdump gets all packets from interface eth0 as seen in the bus, but
> doesn't do the same in dummy0. I'll explain it further...

[snip]

>     If I do exactly the same from the machine running tcpdump and the
> filter, I cannot connect (without the filter I can), but no output
> comes from tcpdump, which is exactly what I expected in the case
> explained in the paragraph above.
> 
>     Is is normal? Is normal that tcpdump shows packets before they
> enter the filter when the interface is a real one (eth0) but no when
> you access through a dummy interface or localhost, or am I missing
> anything?

Try sniffing on the 'lo' interface instead of 'dummy0' since all packets
generated by the local machine destined for the local machine goes via
the ´lo' interface. ipaddresses looks like they belong to interfaces but
that's not the case with linux, they belong to the machine.

'ip route list table local'

All packets destined for entries marked as "local" will go through the
'lo' interface. 

-- 
/Martin

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Packet capturing, iptables and eth0 vs. dummy0

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 921 bytes --]

On Wed, Nov 17, 2004 at 09:30:33PM +0100, DervishD wrote:
>     Hi all :)

Hi!

please send netfilter/iptables related questions to the respective
lists:
	netfilter@lists.netfilter.org (for user questions)
	netfilter-devel@lists.netfilter.org (for development issues)

>     I've noticed that, no matter what filtering is iptables doing,
> tcpdump gets all packets from interface eth0 as seen in the bus, 

This is correct.  iptables is a IPv4 packet filter.  It is part of the
IPv4 stack.  tcpdump uses PF_PACKET which attaches right above the
NIC driver, therefore you capture packets way before they enter the IPv4
stack.

>     Raúl Núñez de Arenas Coronado
-- 
- Harald Welte <laforge@gnumonks.org>               http://www.gnumonks.org/
============================================================================
Programming is like sex: One mistake and you have to support it your lifetime

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Packet capturing, iptables and eth0 vs. dummy0

[DervishD]

    Hi Martin :)

 * Martin Josefsson <gandalf@wlug.westbo.se> dixit:
> >     Is is normal? Is normal that tcpdump shows packets before they
> > enter the filter when the interface is a real one (eth0) but no when
> > you access through a dummy interface or localhost, or am I missing
> > anything?
> Try sniffing on the 'lo' interface instead of 'dummy0' since all packets
> generated by the local machine destined for the local machine goes via
> the ´lo' interface. ipaddresses looks like they belong to interfaces but
> that's not the case with linux, they belong to the machine.

    That seemed to be the problem, thanks :)))

    Raúl Núñez de Arenas Coronado

-- 
Linux Registered User 88736
http://www.dervishd.net & http://www.pleyades.net/

Re: Packet capturing, iptables and eth0 vs. dummy0

[DervishD]

    Hi Harald :)

 * Harald Welte <laforge@gnumonks.org> dixit:
> On Wed, Nov 17, 2004 at 09:30:33PM +0100, DervishD wrote:
> please send netfilter/iptables related questions to the respective
> lists:
> 	netfilter@lists.netfilter.org (for user questions)
> 	netfilter-devel@lists.netfilter.org (for development issues)

    This time the iptables issue was just... collateral, so to say.
The problem was with tcpdump since I knew that packets were being
filtered.
 
> >     I've noticed that, no matter what filtering is iptables doing,
> > tcpdump gets all packets from interface eth0 as seen in the bus, 
> This is correct.  iptables is a IPv4 packet filter.  It is part of the
> IPv4 stack.  tcpdump uses PF_PACKET which attaches right above the
> NIC driver, therefore you capture packets way before they enter the IPv4
> stack.

    OK, I didn't see the problem from that perspective. Anyway, using
'lo' instead of 'dummy' solved the problem :)

    Thanks for the help :)

    Raúl Núñez de Arenas Coronado

-- 
Linux Registered User 88736
http://www.dervishd.net & http://www.pleyades.net/