RE: route problem

-----Original Message-----
From: Bill Fink [mailto:billfink@mindspring.com] 
Sent: Thursday, January 19, 2012 6:59 AM
To: Eric Dumazet
Cc: Prashant Batra (prbatra); netdev@vger.kernel.org
Subject: Re: route problem

On Wed, 18 Jan 2012, Eric Dumazet wrote:

Le mercredi 18 janvier 2012 à 15:38 +0530, Prashant Batra (prbatra) a
écrit :

quoted

2.6.18 kernel.

Please dont top post on netdev mailing list

quoted

-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@gmail.com] 
Sent: Wednesday, January 18, 2012 2:58 PM
To: Prashant Batra (prbatra)
Cc: netdev@vger.kernel.org
Subject: Re: route problem

Le mercredi 18 janvier 2012 à 14:47 +0530, Prashant Batra (prbatra) a
écrit :

quoted

Hi,

I have added a route for an external ip via a gateway which is available
on the same machine.
I want to capture the packets going to this external IP using PF_PACKET
socket.

#route 
Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface
192.168.101.0   *               255.255.255.0   U     0      0        0
eth1
172.16.60.0     192.168.101.10  255.255.255.0   UG    0      0        0
eth1

So, when a packet is sent to 172.16.60.*, kernel should send arp request
for this gw IP 192.168.101.10. As gw IP is locally reachable, 
It should send its mac address in arp-response and kernel should send
the packet via that interface.

But what I am seeing is that instead of asking the gateway IP, kernel
sends a arp request for destingation ip(172.16.60.*)

#tcpdump -I eth1
04:12:45.334966 arp who-has 172.16.60.2 tell 192.168.101.20
04:12:46.334839 arp who-has 172.16.60.2 tell 192.168.101.20
04:12:48.334584 arp who-has 172.16.60.2 tell 192.168.101.20
04:12:49.334457 arp who-has 172.16.60.2 tell 192.168.101.20
04:12:50.335329 arp who-has 172.16.60.2 tell 192.168.101.20
04:12:52.335075 arp who-has 172.16.60.2 tell 192.168.101.20
04:12:53.334947 arp who-has 172.16.60.2 tell 192.168.101.20
04:12:54.334821 arp who-has 172.16.60.2 tell 192.168.101.20

This comes from another machine, since your eth1 addr is 192.168.101.10

Actually, if I'm interpreting the "ip route list cache" output
correctly, it appears it has local IP addresses of both 192.168.101.10
and 192.168.101.20.
[Prashant] Yes both IPs are present on the same machine but on different interfaces.

local 192.168.101.10 from 192.168.101.101 dev lo  src 192.168.101.10 
    cache <local,src-direct>  iif eth1

local 192.168.101.20 from 192.168.101.101 dev lo  src 192.168.101.20 
    cache <local,src-direct>  iif eth1

And since his gateway is 192.168.101.10, an apparently local
IP address, that would probably explain the direct ARPS for
172.16.60.*.

[Prashant] So is this the correct behavior? What my original intention was to capture the packets from the 
interface acting as gateway. So with this behavior I will not be able to capture the packets as 172.16.60.* are not 
present on the local machine, and it will not get any ARP response.
Consider the gateway on a different machine, in which case ARP request will go for gateway IP, and local machine will 
get the ARP response and send the packets to gateway.

Regards,
Prashant
						-Bill