Re: Kernel 2.6.13: TCP (libnet?)

[Patrick McHardy <kaber@trash.net>]

John McGowan wrote:
> Kernel 2.6.13: TCP (libnet?)
> 
> Broken libnet?
> 
> KERNEL: linux-kernel@vger.kernel.org
> LIBNET 1.1 (c) 1998 - 2004 Mike D. Schiffman <mike@infonexus.com>
> 
> I don't like spam. I track spamvertized sites. Many only respond to TCP
> packets sent to port 80. I need a TCP traceroute (traceroute using TCP/SYN
> packets).
> 
> I have four such programmes.
> 
> 1: Hping in traceroute mode.
>    Poor. If it hits a router which does not respond, it just sits
>    and waits.
> 2: LFT
>    OK.
>    a: Does not work in Fedora Core2 - without patching.
>       The source code expects a header of zero bytes in the
>       pcap output of zero bytes (hard coded in the source).
>       My captures have a "linux cooked capture" header of sixteen bytes.
>       Changing an offset from zero to sixteen gets it to work.
>    b: Requires traffic on the interface.
>       It seems it gets into a loop and awaits some traffic.
>       It examines it - if it is data it expects it uses it.
>       If it is other data from other programmes accessing the 'net
>       it does nothing with it.
>       In both those cases it moves on and starts over.
>       What if there is no traffic? Unless there is something for it
>       either to use or ignore, it seems to hang. To get it to work
>       I have to, say, read the NY Times online while running it.
>       (I believe the traceproto site mentions doing something to
>       get around the timeout problem)
>    Output is OK - but I don't really like it.
> 3: Tcptraceroute
>    I have used this since kernel 2.2 through 2.4
>    (older version with older version of libnet) and
>    2.6.5, 2.6.7, 2.6.9, 2.6.10, 2.6.11, 2.6.12
>    It was my favourite until I got traceproto.
> 4: Traceproto
>    I have used this in kernels 2.4,
>    2.6.5, 2.6.7, 2.6.9, 2.6.10, 2.6.11, 2.6.12
>    Good.
> 
> 
> In kernel 2.6.13: [patching 2.1.12 with the patch file]
> 
>  Standard "traceroute" works.
>  LFT works.
>  HPING works (also in traceroute mode).
>  tcptraceroute fails.
>  traceproto (tcp or udp mode) fails.
> 
> How do they fail?
> 
> A TCPDUMP shows that they do send out the packets.
> I do get back ICMP "time exceeded" error messages.
> They no longer recognize them.
> 
> Something that had never changed before has now changed
> and has broken traceproto and tcptraceroute. 

[netdev CC'ed]

Could you provide tcpdump dumps and your .config file please?