pktstat and netfilter

pktstat and netfilter

[Edmund]

Hi,

I'm running iptables (latest version) on a 2.4.21
Linux machine.  I use pktstat to view the general
packet movement.  Setup as follows:

Internet -> eth0 (<- iptables ->) eth1 -> LAN

I'm not sure where pktstat comes into play in
the above chart.

Anyway, today I was majorly surprised to see
a Local IP sending a packet to a remote LAN
on port 80.

    tcp  192.168.10.3:2041 <-> x.x.x.x:80


Is this supposed to happen?  Assuming that
pktstat listens to the resulting packet
after NAT'd, shouldn't the 192.168.10.3
be my actual Internet IP?

Any help appreciated.

Re: pktstat and netfilter

[Cedric Blancher]

Le mar 05/08/2003 à 09:52, Edmund a écrit :
> Anyway, today I was majorly surprised to see
> a Local IP sending a packet to a remote LAN
> on port 80.
>     tcp  192.168.10.3:2041 <-> x.x.x.x:80
> Is this supposed to happen?  Assuming that
> pktstat listens to the resulting packet
> after NAT'd, shouldn't the 192.168.10.3
> be my actual Internet IP?

Afaik, libpcap capture outgoing traffic at last routing point, i.e.
before NF_IP_POST_ROUTING hook. Thus, packets you get are not yet
SNATed.
I think it's merely the same for inbound traffic (need someone to
confirm), that is captured after NF_IP_PRE_ROUTING hook, and so is
already DNATed.

It's quite wierd as one would like to capture the very traffic that is
sent to the wire or traffic recieved from the wire unaltered, whatever
active ruleset.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: pktstat and netfilter

[Edmund]

Cedric Blancher wrote:

> It's quite wierd as one would like to capture the very traffic that is
> sent to the wire or traffic recieved from the wire unaltered, whatever
> active ruleset.
> 

What's even weird is that during a www session, most of the
packets would originate from my NAT firewall's IP, but one
or two (in a sequence) would show a LAN IP.

I'm confused as to why this is happening.

Has anyone encountered something similar?

Re: pktstat and netfilter

[Cedric Blancher]

Le mer 06/08/2003 à 06:02, Edmund a écrit :
> Cedric Blancher wrote:
> > It's quite wierd as one would like to capture the very traffic that is
> > sent to the wire or traffic recieved from the wire unaltered, whatever
> > active ruleset. 
> What's even weird is that during a www session, most of the
> packets would originate from my NAT firewall's IP, but one
> or two (in a sequence) would show a LAN IP.

Have to check what I was telling you before. Have a big big doubt about
it...

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE