From: "Покотиленко Костик" <casper@meteor.dp.ua>
To: netfilter@lists.netfilter.org
Subject: 2.6.8 vs 2.6.18 tcpdump chapture point changed?
Date: Wed, 21 Mar 2007 13:41:36 +0200 [thread overview]
Message-ID: <1174477296.15877.20.camel@localhost.localdomain> (raw)
Hi there.
Background:
Clients(10.10.0.0/16) <-> Router(br0:10.10.100.1, eth0:192.168.1.1) <->
Servers(192.168.1.0/25)
Server2: 192.168.1.3
Nat rule on Router:
# WWW-services on Server2
iptables -t nat -A PREROUTING -i br0 -d 192.168.1.130 -p tcp -m tcp
--dport 80 -j DNAT --to-destination 192.168.1.3:80
Some time ago, when the Router kernel was 2.6.8 doing tcpdump -i br0 I
was able to see DNAT'ed traffic like it was seen be clients, e.g
10.10.102.139:* <-> 192.168.1.130:80. Now the router runs 2.6.18,
iptables rules did not change, the picture I see is:
#tcpdump -i br0 -n net 192.168.1.0/24
13:15:32.922055 IP 10.10.102.139.1075 > 192.168.1.3.80: S
401022809:401022809(0) win 65535 <mss 1460,nop,nop,sackOK>
13:15:32.922350 IP 192.168.1.130.80 > 10.10.102.139.1075: S
796867770:796867770(0) ack 401022810 win 5840 <mss 1460,nop,nop,sackOK>
13:15:32.922558 IP 10.10.102.139.1075 > 192.168.1.3.80: . ack 796867771
win 65535
13:15:32.927802 IP 10.10.102.139.1075 > 192.168.1.3.80: P 0:469(469) ack
1 win 65535
13:15:32.928234 IP 192.168.1.130.80 > 10.10.102.139.1075: . ack 470 win
6432
13:15:33.176471 IP 192.168.1.130.80 > 10.10.102.139.1075: . 1:1461(1460)
ack 470 win 6432
13:15:33.176534 IP 192.168.1.130.80 > 10.10.102.139.1075: .
1461:2921(1460) ack 470 win 6432
So it seems like in 2.6.8 tcpdump captured packets before DNAT and after
un-DNAT, but in 2.6.18 tcpdump captures AFTER DNAT, and after un-DNAT.
Can someone comfirm my thoughts?
--
Покотиленко Костик <casper@meteor.dp.ua>
reply other threads:[~2007-03-21 11:41 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1174477296.15877.20.camel@localhost.localdomain \
--to=casper@meteor.dp.ua \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox