清除rp_filter后丢包

Question

我在tcpdump中看到某些数据包，无法跟踪它们发生了什么。我确实在所有接口上设置了rp_filter to 0和log_martians to 1。我也在iptable中启用了跟踪。

root@sindhu# iptables --list-rules -t raw
-P PREROUTING ACCEPT
-P OUTPUT ACCEPT
-A PREROUTING -p tcp -j TRACE
-A OUTPUT -p tcp -j TRACE

不过，在tcpdump中，我仍然没有看到属于包的跟踪。我在iptables中为这些数据包创建了一个特定的规则，但是该规则的计数不会增加。我遗漏了什么吗？我已经调试了两天了。任何帮助都会很感激的。

编辑:按要求添加更多详细信息。

Tcpdump：

03:01:07.625357 IP (tos 0x0, ttl 63, id 6637, offset 0, flags [DF], proto TCP (6), length 60)
    192.168.103.1.33950 > 192.168.100.100.81: Flags [S], cksum 0x29b9 (correct), seq 2582058365, win 29200, options [mss 1460,sackOK,TS val 4467432 ecr 0,nop,wscale 7], length 0
03:01:07.625362 IP (tos 0x0, ttl 63, id 41508, offset 0, flags [DF], proto TCP (6), length 60)
    192.168.103.1.33951 > 192.168.100.100.81: Flags [S], cksum 0x7ddb (correct), seq 2897653386, win 29200, options [mss 1460,sackOK,TS val 4467432 ecr 0,nop,wscale 7], length 0

表：

# iptables --list -vxn 
Chain INPUT (policy ACCEPT 1278 packets, 102705 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
       0        0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:81

Chain FORWARD (policy ACCEPT 42 packets, 2520 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 779 packets, 104083 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

# iptables --list -vxn -t nat
Chain PREROUTING (policy ACCEPT 7 packets, 420 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:81

Chain INPUT (policy ACCEPT 1 packets, 60 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:81

Chain OUTPUT (policy ACCEPT 37 packets, 2306 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 17 packets, 1146 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
      48     3072 MASQUERADE  all  --  *      vEth0   0.0.0.0/0            0.0.0.0/0           

# iptables --list -vxn -t raw
Chain PREROUTING (policy ACCEPT 1491 packets, 119478 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
       0        0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:81
    2088   169549 TRACE      tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 891 packets, 117135 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
    1236   169357 TRACE      tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   

可以看到，所有特定于dport 81的输入/预出规则都有0分组计数。

其他设置：

# sysctl -a | grep \\.rp_filter
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.vEth0.rp_filter = 0

# sysctl -a| grep martians
net.ipv4.conf.all.log_martians = 1

该数据包被发送到在端口81上运行的本地The服务器。

# netstat -at | grep 81
tcp        0      0 *:81                    *:*                     LISTEN     

数据包的目标地址192.168.100.100是机器上vEth0的地址。

root@cfae:/opt/pep/filesystem# ifconfig vEth0
vEth0     Link encap:Ethernet  HWaddr 0e:c9:59:d9:75:ce  
          inet addr:192.168.100.100  Bcast:192.168.100.255  Mask:255.255.255.0
# ip route get 192.168.100.100 from 192.168.103.1 iif vEth0
local 192.168.100.100 from 192.168.103.1 dev lo  src 192.168.100.100 
    cache <local>  iif vEth0

Answer 1

我发现了这个问题，以太网帧是坏的(从意义上说，vEth0地址不是mac地址)。在第二层处理之前，我还没有意识到tcpdump会嗅探数据包。