On Thursday 06 of October 2005 18:47, you wrote:
> On Tue, 4 Oct 2005, Marek Zachara wrote:
> > Just to make sure, i have compiled kernel 2.4.31 and also switched back
> > to 1.2.11 iptables. But nothing changed. Still the packets don't get
> > SNAT-ed and there has been no hit on SNAT rule for about an hour (packets
> > are sent every ten seconds or so). This only applies to UDP packets.
>
> Any more details on these UDP packets, combined with what matching
> sessions you have in /proc/net/ip_conntrack?
>
Here is hex packet dump at outgoing interface:
irongate:~# tcpdump -xx -ni eth1 udp port 4569
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
13:54:00.826562 IP 10.0.0.250.4569 > 83.16.54.250.4569: UDP, length: 12
0x0000: 0050 da48 557b 0050 ba54 c1e6 0800 4510 .P.HU{.P.T....E.
0x0010: 0028 19f0 4000 3f11 8cc1 0a00 00fa 5310 .(..@.?.......S.
0x0020: 36fa 11d9 11d9 0014 70d9 8001 0000 0000 6.......p.......
0x0030: 4e33 0200 0602 N3....
13:54:00.826663 IP 10.0.0.250.4569 > 83.16.54.250.4569: UDP, length: 12
0x0000: 0050 da48 557b 0050 ba54 c1e6 0800 4510 .P.HU{.P.T....E.
0x0010: 0028 19f1 4000 3f11 8cc0 0a00 00fa 5310 .(..@.?.......S.
0x0020: 36fa 11d9 11d9 0014 6fcd 8001 0000 0000 6.......o.......
0x0030: 4e36 0300 060b N6....
13:54:02.828069 IP 10.0.0.250.4569 > 83.16.54.250.4569: UDP, length: 12
0x0000: 0050 da48 557b 0050 ba54 c1e6 0800 4510 .P.HU{.P.T....E.
0x0010: 0028 19f2 4000 3f11 8cbf 0a00 00fa 5310 .(..@.?.......S.
0x0020: 36fa 11d9 11d9 0014 f0d8 8001 8000 0000 6...............
0x0030: 4e33 0200 0602 N3....
13:54:02.828163 IP 10.0.0.250.4569 > 83.16.54.250.4569: UDP, length: 12
0x0000: 0050 da48 557b 0050 ba54 c1e6 0800 4510 .P.HU{.P.T....E.
0x0010: 0028 19f3 4000 3f11 8cbe 0a00 00fa 5310 .(..@.?.......S.
0x0020: 36fa 11d9 11d9 0014 efcc 8001 8000 0000 6...............
0x0030: 4e36 0300 060b N6....
13:54:02.828239 IP 10.0.0.250.4569 > 83.16.54.250.4569: UDP, length: 12
0x0000: 0050 da48 557b 0050 ba54 c1e6 0800 4510 .P.HU{.P.T....E.
0x0010: 0028 19f4 4000 3f11 8cbd 0a00 00fa 5310 .(..@.?.......S.
0x0020: 36fa 11d9 11d9 0014 18e0 8001 8000 0000 6...............
0x0030: 2723 0100 060b '#....
13:54:02.828316 IP 10.0.0.250.4569 > 83.16.54.250.4569: UDP, length: 25
0x0000: 0050 da48 557b 0050 ba54 c1e6 0800 4510 .P.HU{.P.T....E.
0x0010: 0035 19f5 4000 3f11 8caf 0a00 00fa 5310 .5..@.?.......S.
0x0020: 36fa 11d9 11d9 0021 4581 8001 8000 0000 6......!E.......
0x0030: 0012 0000 060d 0607 7065 7267 6f6c 6513 ........pergole.
0x0040: 0200 3c ..<
6 packets captured
387 packets received by filter
0 packets dropped by kernel
here is the conntrack entry:
irongate:~# cat /proc/net/ip_conntrack |grep 4569
udp 17 28 src=10.0.0.250 dst=83.16.54.250 sport=4569 dport=4569
[UNREPLIED] src=83.16.54.250 dst=10.0.0.250 sport=4569 dport=4569 use=1
the counter at iptables got only 8 packets, but the router has been up for
about 6 hours and these packets are being sent every few seconds:
Chain POSTROUTING (policy ACCEPT 73434 packets, 3691K bytes)
pkts bytes target prot opt in out source destination
8 704 SNAT udp -- * eth1 0.0.0.0/0 0.0.0.0/0
udp dpt:4569 to:192.168.100.1
thanks for the help
Marek
P.S. Here are more details if you need them:
https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=390
