[...]
> If IPv4 Protocol is TCP, go to 10, else go to 11
>
> > (010) ret #0
>
> Reject packet
>
> > (011) ret #262144
>
> Accept packet
>
> So that *looks* OK.
Thank you for the analysis!
>
> Could you run "tcpdump -i eth0 -xx not tcp" and see what the contents of the
> TCP packets being accepted are?
I have to correct myself: "tcpdump -pni eth0 not tcp" actually yields both TCP
and everything else (ARP and UDP). It turns out that during all previous runs
that "everything else" just didn't make it to the screen because of timing. Now
it does, please see:
root@homepc:~# tcpdump -pni eth0 -xx not tcp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:56:19.466860 IP 109.74.202.168.6633 > 10.0.75.2.56538: Flags [.], ack
2668283334, win 235, options [nop,nop,TS val 521910355 ecr 1688339], length 0
0x0000: d4ca 6d72 b1da 000f ea18 f623 8100 004b
0x0010: 0800 4500 0034 dd1d 4000 3406 dcb1 6d4a
0x0020: caa8 0a00 4b02 19e9 dcda 6f36 d02b 9f0a
0x0030: c5c6 8010 00eb b34a 0000 0101 080a 1f1b
0x0040: b853 0019 c313
00:56:20.332325 ARP, Request who-has 10.0.75.3 tell 10.0.75.254, length 28
0x0000: d4ca 6d66 cf65 000f ea18 f623 8100 004b
0x0010: 0806 0001 0800 0604 0001 000f ea18 f623
0x0020: 0a00 4bfe 0000 0000 0000 0a00 4b03
It looks like the filter just has no effect at all, as "tcpdump -pni eth0 not
arp" also delivers a similar mix of packets including ARP.
> And what does "tcpdump -v" print? Was it built with the latest libpcap?
> This might be an issue with the kernel and libpcap not properly working
> together to deal with VLAN tags - this commit:
>
> commit 04660eb1e56102e2369473cae2538e4d3d263607
> Author: Michal Sekletar <msekl...@redhat.com>
> Date: Fri Oct 31 15:19:54 2014 +0100
>
> Use BPF extensions in compiled filters
>
> libpcap will generate BPF filter code which uses BPF extensions if
> target
> platform supports them. Currently supported BPF extensions are
> vlan_tci and
> vlan_pr.
>
> Also to properly handle such filters when filtering in userspace
> libpcap now
> employs bpf_filter1.
>
> fixed some issues there.
>
It is today's master branch build of both:
root@homepc:~# tcpdump --version
tcpdump version 4.7.0-PRE-GIT_2015_01_28
libpcap version 1.7.0-PRE-GIT_2015_01_28
OpenSSL 1.0.1f 6 Jan 2014
This Ubuntu host has no BPF extensions:
denis@homepc:~/libpcap$ fgrep -r SO_BPF_EXT /usr/include/
denis@homepc:~/libpcap$
If this is a new bug, I can file it if it helps.
--
Denis Ovsienko
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
