Re: Packet chain traversals

[Joel Newkirk <netfilter@newkirk.us>]

On Wednesday 30 October 2002 12:22 pm, Antony Stone wrote:
> On Wednesday 30 October 2002 4:11 pm, Matthew G. Marsh wrote:
> > > The only thing I can think of is "which interface should this packet go
> > > out of", however that's certainly not the same sort of "decision" as
> > > there is between PREROUTING and INPUT or FORWARD, and I'm not even sure
> > > it belongs quite where it is shown...
> >
> > It does exist between OUTPUT and NAT. But the decision structure is more
> > along the lines of rule application. Thus you can issue rules such as:

> The only decisions of interest to netfilter are "is the packet local ?" and
> if not "which interface is it going out of ?".   Both of those have already
> been decided in the first routing decision, between prerouting and input /
> forward.
>
> I'm not convinced there's any purpose in having another routing decision
> shown between output and postrouting, especially in a document which is
> aimed at beginners.

I'm planning to rebuild the diagram this weekend, in several forms from 
simplest (in/out/forward/local) to mid (in/out/forward/natpre/natpost/local) 
to full.  I've not yet decided if I'm going to have 'routing decision' in the 
diagram at all, since it seems that the only concrete placement of it is 
after prerouting, and the existence of multiple parts in the next layer 
inward (forward and input) makes the existance of SOME decision pretty 
apparent.  I may just wait until I have a better grasp of the interaction of 
Netfilter and Iproute2 and see where my understanding leads me for a possible 
generation 2 diagram.  :^)

Is there some way that I can expand on Oscar's packet tracking rules to also 
track when the packet hits routing?  I was wondering whether I could set a 
TOS in prerouting and output for testing purposes, and track incidents of 
that TOS in routing.

j