Are there any cases where iptables can be confused about what interface a packet came in on? Can a packet arriving on interface A ever be reported as arriving on interface B?
I had an incident this weekend, and am trying to be certain that the packets came in the interface my system said it did. It's a Red Hat 9 system, running their stock 2.4.20-8 kernel.
Please, can anyone answer this for me? I'm trying to prove or disprove a theory that would explain an apparent intrusion incident over the weekend. It's very important that I know the definitive answer to this. Thanks.
-ste
