Hi, This is related to a couple of messages I sent to the list 3 weeks ago, with some additional information. The basic problem is that Netfilter is seeing some traffic lately as coming in on the wrong interface, which we notice when that traffic gets blocked or gets by when it shouldn't, since some of our rules specify interfaces. We're now seeing the same behavior from both iptables 1.4.8 on Debian Squeeze and 1.3.8 on Ubuntu 8.04 (on totally different hardware). The common factor is that this is all traffic coming in via our Cogent pipe. When traffic comes in via either of our two other Speakeasy/Megapath pipes Netfilter sees all the interface specifications correctly. This makes me wonder if Cogent has started doing some sort of packet mangling that's not compatible with how Netfilter looks at packet headers to determine which interface the packets have shown up from. Could something like that be the case? Or what else could account for this? It does look like Cogent is on the list of providers who have been mucking with stuff they shouldn't - http://www.newscientist.com/article/dn20768-us-internet-providers-hijacking-users-search-queries.html We can work around whatever the problem here is by specifying rules by IP block rather than interface. Still, it's troubling that there can apparently be some characteristic of incoming traffic that can get Netfilter confused about the interface it's arrived on. There have to be evil uses for that. Best, Whit -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
