Re: route problem

[Bill Fink <billfink@mindspring.com>]

On Wed, 18 Jan 2012, Eric Dumazet wrote:

> Le mercredi 18 janvier 2012 à 15:38 +0530, Prashant Batra (prbatra) a
> écrit :
> > 2.6.18 kernel.
> > 
> 
> Please dont top post on netdev mailing list
> 
> > -----Original Message-----
> > From: Eric Dumazet [mailto:eric.dumazet@gmail.com] 
> > Sent: Wednesday, January 18, 2012 2:58 PM
> > To: Prashant Batra (prbatra)
> > Cc: netdev@vger.kernel.org
> > Subject: Re: route problem
> > 
> > Le mercredi 18 janvier 2012 à 14:47 +0530, Prashant Batra (prbatra) a
> > écrit :
> > > Hi,
> > > 
> > > I have added a route for an external ip via a gateway which is available
> > > on the same machine.
> > > I want to capture the packets going to this external IP using PF_PACKET
> > > socket.
> > > 
> > > #route 
> > > Destination     Gateway         Genmask         Flags Metric Ref    Use
> > > Iface
> > > 192.168.101.0   *               255.255.255.0   U     0      0        0
> > > eth1
> > > 172.16.60.0     192.168.101.10  255.255.255.0   UG    0      0        0
> > > eth1
> > > 
> > > So, when a packet is sent to 172.16.60.*, kernel should send arp request
> > > for this gw IP 192.168.101.10. As gw IP is locally reachable, 
> > > It should send its mac address in arp-response and kernel should send
> > > the packet via that interface.
> > > 
> > > But what I am seeing is that instead of asking the gateway IP, kernel
> > > sends a arp request for destingation ip(172.16.60.*)
> > > 
> > > #tcpdump -I eth1
> > > 04:12:45.334966 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:46.334839 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:48.334584 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:49.334457 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:50.335329 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:52.335075 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:53.334947 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 04:12:54.334821 arp who-has 172.16.60.2 tell 192.168.101.20
> > > 
> 
> This comes from another machine, since your eth1 addr is 192.168.101.10

Actually, if I'm interpreting the "ip route list cache" output
correctly, it appears it has local IP addresses of both 192.168.101.10
and 192.168.101.20.

> local 192.168.101.10 from 192.168.101.101 dev lo  src 192.168.101.10 
>     cache <local,src-direct>  iif eth1

> local 192.168.101.20 from 192.168.101.101 dev lo  src 192.168.101.20 
>     cache <local,src-direct>  iif eth1

And since his gateway is 192.168.101.10, an apparently local
IP address, that would probably explain the direct ARPS for
172.16.60.*.

						-Bill