From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nigel Metheringham Subject: Re: NAT and MTU issues Date: Mon, 22 Sep 2003 16:46:59 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1064245619.6070.94.camel@angua.localnet> References: <1063985328.28941.37.camel@angua.localnet> <1064084662.28506.42.camel@tux.rsn.bth.se> <1064224385.6070.8.camel@angua.localnet> <1064242324.6070.77.camel@angua.localnet> <1064243316.6070.85.camel@angua.localnet> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Martin Josefsson Cc: Netfilter On Mon, 2003-09-22 at 16:41, Martin Josefsson wrote: > On Mon, 22 Sep 2003, Nigel Metheringham wrote: > > > Took a closer look. > > If I put that mangle rule in then:- > > * I see no ICMP packets on the wire between the originating box > > and the linux g/w (tested in 2 places to make sure I don't have > > any packet sniffing/netfilter interactions). Previously I saw > > ICMP need frag packets as quoted above > > * those icmp_reply log messages appear to fire on each and every > > packet > > > > icmp_reply: outer SRC -> 192.168.50.119 > > icmp_reply: inner DST -> 192.168.50.119 1500 > > Uhm, let me see if I got this right... > > If you add that mangle rule you don't see any icmp packets on the wire but > you see the icmp_reply messages? yup. With no mangle rule I get broken ICMP frag-needed messages on the wire and your debug messages do not trigger. With the mangle rule I see no ICMP on the wire but the debug messages trigger frequently (ie probably once per packet). I'm confused too! Nigel. -- [ Nigel Metheringham Nigel.Metheringham@InTechnology.co.uk ] [ - Comments in this message are my own and not ITO opinion/policy - ]