Re: new target - ebtables dynamic snat, kernel and userspace patch

[Philip Craig <philipc@snapgear.com>]

Amos Jeffries wrote:
> Shai Tahar wrote:
>> in case you manipulate the data in the connection, such as in tproxy 
>> scenario (squid etc')
>> a new connection goes out (with the same tuple) but the mac address is 
>> diffrent (the source mac is the device interface)
>>
>> assuming A,B,C are mac address and 1,2,3 are ip address
>>
>> [user]<--->[transparent bridge]<--->[server]
>> A1 B2 C3
>>
> 
> Your next steps misunderstand how MAC addresses work. MAC changes at 
> each physical NIC card plugged into the cable.

Not necessarily, and not for a bridge.  That's why bridges put the
NIC in promiscuous mode.

> Corrections follow...
> 
>> user initiates a connection A1--->C3
> 
> Correction:
>   user initiates query A1---->?3
>   network responds  ===> go to 3 via B
>   user initiates connection A1--->B3

That's how proxy arp works, not bridging.  A bridge knows nothing
about IP, it just forwards packets unmodified to the destination
MAC address.