From: Philip Craig <philipc@snapgear.com>
To: Amos Jeffries <squid3@treenet.co.nz>
Cc: Shai Tahar <shait@storwize.com>,
Jan Engelhardt <jengelh@medozas.de>,
netfilter-devel@vger.kernel.org, bdschuym@pandora.be,
shai.tahar@storwize.com
Subject: Re: new target - ebtables dynamic snat, kernel and userspace patch
Date: Fri, 25 Sep 2009 11:04:17 +1000 [thread overview]
Message-ID: <4ABC1711.6050004@snapgear.com> (raw)
In-Reply-To: <4ABB5773.4080500@treenet.co.nz>
Amos Jeffries wrote:
> Shai Tahar wrote:
>> in case you manipulate the data in the connection, such as in tproxy
>> scenario (squid etc')
>> a new connection goes out (with the same tuple) but the mac address is
>> diffrent (the source mac is the device interface)
>>
>> assuming A,B,C are mac address and 1,2,3 are ip address
>>
>> [user]<--->[transparent bridge]<--->[server]
>> A1 B2 C3
>>
>
> Your next steps misunderstand how MAC addresses work. MAC changes at
> each physical NIC card plugged into the cable.
Not necessarily, and not for a bridge. That's why bridges put the
NIC in promiscuous mode.
> Corrections follow...
>
>> user initiates a connection A1--->C3
>
> Correction:
> user initiates query A1---->?3
> network responds ===> go to 3 via B
> user initiates connection A1--->B3
That's how proxy arp works, not bridging. A bridge knows nothing
about IP, it just forwards packets unmodified to the destination
MAC address.
next prev parent reply other threads:[~2009-09-25 1:08 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-09-24 7:43 new target - ebtables dynamic snat, kernel and userspace patch Shai Tahar
2009-09-24 8:12 ` Jan Engelhardt
2009-09-24 8:30 ` Shai Tahar
2009-09-24 11:26 ` Amos Jeffries
2009-09-25 1:04 ` Philip Craig [this message]
2009-09-24 20:24 ` Bart De Schuymer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4ABC1711.6050004@snapgear.com \
--to=philipc@snapgear.com \
--cc=bdschuym@pandora.be \
--cc=jengelh@medozas.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=shai.tahar@storwize.com \
--cc=shait@storwize.com \
--cc=squid3@treenet.co.nz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).