TCPDUMP problems with eth1

TCPDUMP problems with eth1

Post by C » Sat, 26 Jul 2003 12:03:38



I'm having some problems with tcpdump.  I need to capture only tcp
traffic (no udp or icmp) on eth1.  I have libpcap v0.6.2 and tcpdump
v3.6.3 (both are the latest for RedHat v7.3)

# tcpdump tcp
or
# tcpdump -i eth0 tcp
I get TCP trafic. Just what I want.

# tcpdump -i eth1 tcp
I get absolutely nothing.

# tcpdump -i eth1
I get all traffic including TCP.

# tcpdump -i eth1 host 172.30.1.20
I get absolutely nothing

# tcpdump -i eth1 ether host 00:60:38:BD:56:5B and tcp
I get nothing.  This is the MAC for 172.30.1.20

# tcpdump -i eth1 ether host 00:60:38:BD:56:5B
I get all traffic for the host. Sample output is at the end of this
post.

So the question is... is this just a problem with this version?  Could
it have anything to do with the NIC?  I wouldn't think so since
capture works ok without the tcp keywords.  Anybody seen something
like this before?

06:42:56.923414 P0 172.30.1.254.2025 > 172.30.1.20.telnet: S
1864956980:1864956980(0) win 5840 <mss 1460,sackOK,timestamp 257784183
0,nop,wscale 0> (DF) [tos 0x10]
06:42:56.923712 P0 172.30.1.20.telnet > 172.30.1.254.2025: S
976909757:976909757(0) ack 1864956981 win 8192 <mss 1460,nop,wscale 0>
06:42:56.924589 P0 172.30.1.254.2025 > 172.30.1.20.telnet: . ack 1 win
5840 (DF) [tos 0x10]

 
 
 

1. eth1 problems - eth0:LAN:tulip eth1:DSL:3c509 w/ipmasq (static IP)

System:
Latest distribution (4.0 - kernel 2.2.6) of slackware. Freshly compiled
kernel with support for ipmasq and both ethernet cards (tulip:eth0 and
3c509:eth1).

Problem:
For security purposes I have substituted X.X.X.X for my static IP address
(on DSL) and Z.Z.Z.Z for my ISP's gateway machine throughout this document.

For some reason, eth1 and ipmasq functioning between eth0 and eth1 are not
working. Symptoms are described in the next few paragraphs.

From this machine or any machine on the LAN I can ping X.X.X.X but not
Z.Z.Z.Z

If I change the config files so the LAN is on eth1 and DSL is on eth0 I can
then ping Z.Z.Z.Z (also X.X.X.X & 192.168.150.1) from the linux box but I
cannot communicate with the rest of the LAN and the LAN cannot communicate
with the linux box. (I get full internet service on the linux box with this
configuration)

If I connect another computer directly to the DSL line, that machine can
reach the internet via DSL (again internet service is working correctly)

Relevant Config File Lines:

lilo.conf:
append = "ether=0,0,eth0 ether=0,0,eth1"

rc.inet1:
/sbin/ifconfig lo 127.0.0.1
/sbin/route add -net 127.0.0.0 netmask 255.0.0.0 lo

/sbin/ifconfig eth0 192.168.0.1 netmask 255.255.255.0 up

/sbin/ifconfig eth1 X.X.X.X netmask 255.255.255.0 up

/sbin/route add default gw Z.Z.Z.Z netmask 0.0.0.0 metric 1 dev eth1

rc.firewall:
echo "1"> /proc/sys/net/ipv4/ip_forward

/sbin/ipchains -P forward DENY
/sbin/ipchains -A forward -s 192.168.0.0/24 -j MASQ -i eth1

Relevent Output From Several Commands:

/sbin/route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
X.X.X.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 X.X.X.X 0.0.0.0 UG 1 0 0 eth1

/sbin/ifconfig
eth0 Link encap:Ethernet HWaddr ##:##:##:##:##:##
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

eth1 Link encap:Ethernet HWaddr ##:##:##:##:##:##
inet addr:X.X.X.X Bcast:Z.Z.Z.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:3924 Metric:1

/sbin/ipchains --list -n
Chain input (policy ACCEPT):
Chain forward (policy DENY):
target  prot  opt     source          destination  ports
MASQ    all   ------  192.168.0.0/24  0.0.0.0/0    n/a

2. Problem with pl12: error reading kmem (offset 0x800000)

3. TCPDUMP on eth1?

4. Selectively deleting records

5. Problem with TCPDUMP ( it says : "tcpdump: socket: Invalid argument" ??!!

6. UUCP

7. CorelLinux

8. eth0 and eth1 "Delaying eth0 Initialization" and "Delaying eth1 Initialization" errors

9. TCPDUMP how to configure bpf0 for tcpdump?

10. eth1 Transmit timeout problem, help

11. IP Aliases problem with Redhat and Eth1:8

12. networking linux and xp box, eth1 small problem