On Mon, Mar 12, 2001 at 11:11:40PM +0000, Jim Breton wrote: > Again, I'm not disagreeing with you. rp_filter and source checking has > nothing to do with the issue though. The question posed was about > packet destinations, and you keep referring to source checks. Arggghh! Sorry, you're right. I was pretty sure that linux checked the dest of packets before accepting them, so I guess my brain decided to read it wrong and think you were talking about what I expected you to be a talking about :(
I decided to check this out, partly since I owe you one for being an idiot and not listening to what you told me twice! llama is 10.0.0.1, MAC 00:00:92:96:51:C0. bigfoot is 10.0.0.4, MAC 00:05:02:D4:B7:0A. On bigfoot, I used arp -s to point a nonexistant IP to the same MAC address as llama, a linux machine running 2.2.18. bigfoot:~# arp Address HWtype HWaddress Flags Mask Iface 10.0.0.10 ether 00:00:92:96:51:C0 CM eth0 llama ether 00:00:92:96:51:C0 C eth0 bigfoot:~# nc 10.0.0.10 25 (UNKNOWN) [10.0.0.10] 25 (smtp) : No route to host before attempting the connection, I did: llama:~# tcpdump -p -e -n -i eth1 port ! ssh tcpdump: listening on eth1 22:03:23.249795 0:5:2:d4:b7:a 0:0:92:96:51:c0 0800 74: 10.0.0.4.3641 > 10.0.0.10.25: S 1026521176:1026521176(0) win 5840 <mss 1460,sackOK,timestamp 59103824 0,nop,wscale 0> (DF) 22:03:23.250230 0:0:92:96:51:c0 0:5:2:d4:b7:a 0800 102: 10.0.0.1 > 10.0.0.4: icmp: redirect 10.0.0.10 to host 10.0.0.10 [tos 0xc0] 22:03:23.250502 0:0:92:96:51:c0 ff:ff:ff:ff:ff:ff 0806 42: arp who-has 10.0.0.10 tell 10.0.0.1 22:03:24.243578 0:0:92:96:51:c0 ff:ff:ff:ff:ff:ff 0806 42: arp who-has 10.0.0.10 tell 10.0.0.1 22:03:25.243324 0:0:92:96:51:c0 ff:ff:ff:ff:ff:ff 0806 42: arp who-has 10.0.0.10 tell 10.0.0.1 22:03:26.243237 0:0:92:96:51:c0 0:5:2:d4:b7:a 0800 102: 10.0.0.1 > 10.0.0.4: icmp: host 10.0.0.10 unreachable [tos 0xc0] Notice that with the interface not in promiscuous mode (-p), tcpdump still received the SYN packet, but the kernel didn't start a connection. exim is listening on *:25, (i.e. INADDR_ANY, not the interface addresses). nc 10.0.0.1 25 connects to exim normally. It's not so easy to check what happens if you send a packet with a destination in 127.0.0.0/8, but I'd be surprised if it was accepted. -- #define X(x,y) x##y Peter Cordes ; e-mail: X([EMAIL PROTECTED] , ns.ca) "The gods confound the man who first found out how to distinguish the hours! Confound him, too, who in this place set up a sundial, to cut and hack my day so wretchedly into small pieces!" -- Plautus, 200 BCE
