* How do we determine IP Address of interface the packet arrived on
2014-09-24 7:41 ` Vlad Dogaru
@ 2014-09-24 12:03 ` 정현
2014-09-24 12:24 ` Valdis.Kletnieks at vt.edu
2014-09-24 14:08 ` John de la Garza
` (2 subsequent siblings)
3 siblings, 1 reply; 10+ messages in thread
From: 정현 @ 2014-09-24 12:03 UTC (permalink / raw)
To: kernelnewbies
And you should be careful about obtained IP address, because it is made by
IP spoofing attack or some sort of IP camo technique.
Hope this helps too,
Hyun
On Sep 24, 2014 4:42 PM, "Vlad Dogaru" <ddvlad@herebedragons.ro> wrote:
> On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
> > Hi,
> >
> > Each time a packet arrives at a router in a subnet during transit, I
> > need to determine the IP address of the incoming interface of the
> > router for that packet. I have a netfilter kernel module running at
> > each router but I dont understand which data structure will give me
> > thw IP address. Can someone please suggest how shall I get that?
>
> An interface can have more than one IP address, so your question is a
> little strange.
>
> However, you can find out all the IPv4 addresses a particular device has
> by iterating through dev->ip_ptr->ifa_list.
>
> Hope this helps,
> Vlad
>
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20140924/12e024c7/attachment.html
^ permalink raw reply [flat|nested] 10+ messages in thread* How do we determine IP Address of interface the packet arrived on
2014-09-24 7:41 ` Vlad Dogaru
2014-09-24 12:03 ` 정현
@ 2014-09-24 14:08 ` John de la Garza
2014-09-24 16:22 ` Valdis.Kletnieks at vt.edu
2014-09-24 16:34 ` Jeff Haran
2014-09-25 3:14 ` maninder.tiet at gmail.com
3 siblings, 1 reply; 10+ messages in thread
From: John de la Garza @ 2014-09-24 14:08 UTC (permalink / raw)
To: kernelnewbies
On Wed, Sep 24, 2014 at 10:41:54AM +0300, Vlad Dogaru wrote:
> On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
> > Hi,
> >
> > Each time a packet arrives at a router in a subnet during transit, I
> > need to determine the IP address of the incoming interface of the
> > router for that packet. I have a netfilter kernel module running at
> > each router but I dont understand which data structure will give me
> > thw IP address. Can someone please suggest how shall I get that?
>
> An interface can have more than one IP address, so your question is a
> little strange.
>
why not look at the destination ip of the ip header?
^ permalink raw reply [flat|nested] 10+ messages in thread
* How do we determine IP Address of interface the packet arrived on
2014-09-24 14:08 ` John de la Garza
@ 2014-09-24 16:22 ` Valdis.Kletnieks at vt.edu
0 siblings, 0 replies; 10+ messages in thread
From: Valdis.Kletnieks at vt.edu @ 2014-09-24 16:22 UTC (permalink / raw)
To: kernelnewbies
On Wed, 24 Sep 2014 10:08:29 -0400, John de la Garza said:
> why not look at the destination ip of the ip header?
It's possible to receive a packet on the "wrong" interface.
For instance, we have a software package installed here that
insists on talking on one IP address, so we end up with this
setup:
world - 198.82.X.Y- |BOX| - 172.28.40.z - private 10G net - clientbox
and the client box does a 'route add host 198.82.x.y gw 172.28.40.z', so
when it sends packets to 198.82.x.y, it shows up on the box's 10G interface.
Said packet is then cheerfully accepted, because the destination address
matches *one* of the boxes's addresses (just on a different interface).
Another similar situation is for HA, where you'll have a pair (or more) of
boxes that each have their own IP address on a subnet, and a floating IP that's
used by client machines to actually access the service, and which moves back
and forth if a box fails or is down for maintenance. So the active one of the
HA pair has 2 addresses on the interface.
And that's not even starting on the case of "Linux-based router", where
*most* packets you handle don't have your IP address in the destination
field, because you are going to forward it.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20140924/b702dc34/attachment.bin
^ permalink raw reply [flat|nested] 10+ messages in thread
* How do we determine IP Address of interface the packet arrived on
2014-09-24 7:41 ` Vlad Dogaru
2014-09-24 12:03 ` 정현
2014-09-24 14:08 ` John de la Garza
@ 2014-09-24 16:34 ` Jeff Haran
2014-09-25 3:14 ` maninder.tiet at gmail.com
3 siblings, 0 replies; 10+ messages in thread
From: Jeff Haran @ 2014-09-24 16:34 UTC (permalink / raw)
To: kernelnewbies
> -----Original Message-----
> From: kernelnewbies-bounces at kernelnewbies.org [mailto:kernelnewbies-
> bounces at kernelnewbies.org] On Behalf Of Vlad Dogaru
> Sent: Wednesday, September 24, 2014 12:42 AM
> To: Maninder Singh
> Cc: kernelnewbies at kernelnewbies.org
> Subject: Re: How do we determine IP Address of interface the packet arrived on
>
> On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
> > Hi,
> >
> > Each time a packet arrives at a router in a subnet during transit, I
> > need to determine the IP address of the incoming interface of the
> > router for that packet. I have a netfilter kernel module running at
> > each router but I dont understand which data structure will give me
> > thw IP address. Can someone please suggest how shall I get that?
>
> An interface can have more than one IP address, so your question is a little
> strange.
>
> However, you can find out all the IPv4 addresses a particular device has by
> iterating through dev->ip_ptr->ifa_list.
>
> Hope this helps,
> Vlad
If what you are trying to determine is whether the incoming packet is destined to the router this code is running on, one option would be to do a route lookup on the destination address in the packet via a call to inet_addr_type(). If it returns RTN_LOCAL, then it will get routed locally. That might be easier that walking the ifa_list. It should also cover the case where the DA is an IP address assigned to another interface on the router that happened to get routed to a different subnet and thus got received on the "wrong" interface.
Of course, things like ip rules and alternative routing tables can make all this much more complicated.
Whether this works for you or not will depends what you are trying to accomplish here,
Jeff Haran
^ permalink raw reply [flat|nested] 10+ messages in thread
* How do we determine IP Address of interface the packet arrived on
2014-09-24 7:41 ` Vlad Dogaru
` (2 preceding siblings ...)
2014-09-24 16:34 ` Jeff Haran
@ 2014-09-25 3:14 ` maninder.tiet at gmail.com
3 siblings, 0 replies; 10+ messages in thread
From: maninder.tiet at gmail.com @ 2014-09-25 3:14 UTC (permalink / raw)
To: kernelnewbies
Hi.. Thanks for your reply. I agree that an interface can have more than one ipv6 addresses but in the PoC I am doing for an IP Traceback technique, I need to record a hash of the IP of incoming interface. For that I need to be able to read the packet.
Your reply gave me a direction to explore the use of dev->ip6_ptr->ac_list .. For ipv6. However I m not sure what is ac_list and what is mc_list here.. I wonder if there is some documentation around it in this world. Can you please give me a pointer or if you could brief me about how do I list all ipv6 addresses of the interface.
Well, yet I tried to get the ip addresses pointed to by ac_list and before I could see if it displays something, system slows down unbelievably with syllogism error as 'takedown serio0. Some program might be trying to access hardware directly." And mouse stops moving. I am not sure if this error is a result of my operation or something else. I will try loading this module Again. But any comments from your side on this please?
Thanks
Maninder
> On 24-Sep-2014, at 1:11 pm, Vlad Dogaru <ddvlad@herebedragons.ro> wrote:
>
>> On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
>> Hi,
>>
>> Each time a packet arrives at a router in a subnet during transit, I
>> need to determine the IP address of the incoming interface of the
>> router for that packet. I have a netfilter kernel module running at
>> each router but I dont understand which data structure will give me
>> thw IP address. Can someone please suggest how shall I get that?
>
> An interface can have more than one IP address, so your question is a
> little strange.
>
> However, you can find out all the IPv4 addresses a particular device has
> by iterating through dev->ip_ptr->ifa_list.
>
> Hope this helps,
> Vlad
^ permalink raw reply [flat|nested] 10+ messages in thread