From: Ralph de Boom <lkml@deboom.biz>
To: Richard Horton <richard.horton@solstans.co.uk>
Cc: Patrick McHardy <kaber@trash.net>, netfilter@vger.kernel.org
Subject: Re: Iptables v1.4.4 + kernel 2.6.31 mangle marking changed?
Date: Thu, 05 Nov 2009 18:53:00 +0100 [thread overview]
Message-ID: <4AF310FC.1060505@deboom.biz> (raw)
In-Reply-To: <56378e320911050352p64455be8ga21655668c361d95@mail.gmail.com>
Richard Horton schreef:
>> Right, at this point you've lost me, how I will manage to do that, and where
>> does the infomation get stored?
>>
>
> You will need to turn trace on...
> iptables -A PREROUTING -t raw -J TRACE will turn tracing on for everything.
>
> The information is then stored in the syslog as per your syslog
> configuration - TRACE will show which rules etc your packets have
> encountered.
>
>
Ok got that since kern.log will get majorly flooded I grepped the output.
If needed I can attach the whole log?
cat kern.log | grep 81.4.97.
Nov 5 18:48:14 sakura kernel: [ 194.028498] fwmark 0x1: IN=eth1 OUT=
MAC=00:1b:21:2d:a9:fa:00:1b:21:32:99:5f:08:00 SRC=192.168.1.30
DST=81.4.97.160 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=13005 DF PROTO=TCP
SPT=52436 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0 MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.028527] TRACE:
mangle:PREROUTING:policy:3 IN=eth1 OUT=
MAC=00:1b:21:2d:a9:fa:00:1b:21:32:99:5f:08:00 SRC=192.168.1.30
DST=81.4.97.160 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=13005 DF PROTO=TCP
SPT=52436 DPT=80 SEQ=2949910603 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0
OPT (0204116C01010402) MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.028570] TRACE:
mangle:FORWARD:policy:1 IN=eth1 OUT=eth0 SRC=192.168.1.30
DST=81.4.97.160 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13005 DF PROTO=TCP
SPT=52436 DPT=80 SEQ=2949910603 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0
OPT (0204116C01010402) MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.028598] TRACE:
filter:FORWARD:rule:1 IN=eth1 OUT=eth0 SRC=192.168.1.30 DST=81.4.97.160
LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13005 DF PROTO=TCP SPT=52436 DPT=80
SEQ=2949910603 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0 OPT
(0204116C01010402) MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.028626] TRACE:
mangle:POSTROUTING:policy:1 IN= OUT=eth0 SRC=192.168.1.30
DST=81.4.97.160 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13005 DF PROTO=TCP
SPT=52436 DPT=80 SEQ=2949910603 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0
OPT (0204116C01010402) MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.149805] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:14 sakura kernel: [ 194.149861] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:15 sakura kernel: [ 195.173980] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:15 sakura kernel: [ 195.174046] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:27 sakura kernel: [ 207.173329] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:27 sakura kernel: [ 207.173394] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:52 sakura kernel: [ 231.380824] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:52 sakura kernel: [ 231.380891] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:49:40 sakura kernel: [ 279.579532] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:49:40 sakura kernel: [ 279.579591] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
next prev parent reply other threads:[~2009-11-05 17:53 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-11-04 0:49 Iptables v1.4.4 + kernel 2.6.31 mangle marking changed? Ralph de Boom
2009-11-04 11:16 ` Patrick McHardy
2009-11-04 13:15 ` Ralph de Boom
2009-11-04 14:10 ` Patrick McHardy
2009-11-04 15:53 ` Ralph de Boom
2009-11-05 11:52 ` Richard Horton
2009-11-05 17:53 ` Ralph de Boom [this message]
2009-11-10 17:34 ` Ralph de Boom
2009-11-11 8:33 ` Richard Horton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4AF310FC.1060505@deboom.biz \
--to=lkml@deboom.biz \
--cc=kaber@trash.net \
--cc=netfilter@vger.kernel.org \
--cc=richard.horton@solstans.co.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.