Ubuntu – Cannot see packets arrive on application socket that were seen by Wireshark

linuxUbuntuudp

Using Ubuntu 14

I have a Linux machine where there are two interfaces:
eth1: 172.16.20.1
ppp0: 192.168.0.2

ppp0 is connected to a device which has a PPP interface (192.168.0.1) and a WAN interface (172.16.20.2). I can verify that this device can reach 172.16.20.1

The problem I am having is if I send a packet using Python on the same machine:

client.py

import socket
cl = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
cl.sendto("Hello", ("172.16.20.1", 5005))

server.py

import socket
srv = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
srv.bind(("", 5005))
while True:
    data, addr = srv.recvfrom(2048)
    print("Message: ", data)

the script works fine but I cannot see the packet on Wireshark coming out of eth1 (I can only see it when I choose to capture on the lo interface). I assume the OS has detected the packet is for one of its local interface and does not send it through the 192.168.0.2 socket created.

When I add the following rules to prevent this from happening:

sudo ip route del table local 172.16.20.1 dev eth1
sudo ip route add table local 172.16.20.1 dev ppp0
sudo ip route flush cache

What happens is:

  • I can see the packets on Wireshark now arriving at eth1, the source address is the address of the WAN (172.16.20.2)
  • I cannot see any output from server.py after restarting the program.

Ignoring the ppp0 interface and using two ethx interfaces:
If I try to run the program in two (client and server) separate machines (without applying the rules), I can see the packets arriving at eth1 in Wireshark, and the output on server.py. If I try to run the program in two separate machines AND I apply the rules above for the ppp0 connection (I have not removed it), I can no longer see any output from server.py but can still see packets arriving on Wireshark. My knowledge of the TCP/IP stack is not good, but it looks like the link layer is no longer forwarding to the application layer?

Best Answer

it looks like the link layer is no longer forwarding to the application layer

The link layer is not the problem; it is not affected by your configuration. This is about the network layer (IP).

The local table is the kernel's way to determine whether a packet can be delivered locally. You delete the IP address, the packet is routed or dropped.

I guess this works only because the MAC address is in the other system's ARP cache. I would expect the receiving system not to answer to ARP requests if the address is missing in the local table.

Related Question