Bug 9145 - udp packets not blocked at ppp0
Summary: udp packets not blocked at ppp0
Status: REJECTED INVALID
Alias: None
Product: Networking
Classification: Unclassified
Component: Netfilter/Iptables (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: networking_netfilter-iptables@kernel-bugs.osdl.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-10-12 01:57 UTC by Toralf Förster
Modified: 2007-10-16 07:38 UTC (History)
0 users

See Also:
Kernel Version: 2.6.23
Subsystem:
Regression: ---
Bisected commit-id:

Attachments
udp packets (12.63 KB, application/octet-stream)
2007-10-12 01:58 UTC, Toralf Förster 		Details
firewall script (9.12 KB, text/plain)
2007-10-12 01:59 UTC, Toralf Förster 		Details
udp packets sniffed with wireshark (2.42 KB, application/octet-stream)
2007-10-13 08:26 UTC, Toralf Förster 		Details
Add an attachment (proposed patch, testcase, etc.)

Description Toralf Förster 2007-10-12 01:57:48 UTC 
Most recent kernel where this bug did not occur:
Distribution:Gentoo
Hardware Environment:ThinkPad T41
Software Environment:Gentoo Linux
Problem Description:
Although I defined firewall rules to block all incoming UDP packets at interface ppp0 I can capture UDP packets at interface eth0 if eth0 is set into promiscuous mode.

Steps to reproduce:
$>tcpdump udp -i eth0 -s 0 -U -v -w tcpdump_eth0_pm.pcap

I'll attach the captured data as well as the firewall script itself.
Comment 1 Toralf Förster 2007-10-12 01:58:31 UTC 
Created attachment 13123 [details]
udp packets
Comment 2 Toralf Förster 2007-10-12 01:59:02 UTC 
Created attachment 13124 [details]
firewall script
Comment 3 Patrick McHardy 2007-10-12 04:11:43 UTC 
The firewall blocks reception at the IP layer, not at the interface layer.

Please close, invalid.
Comment 4 Toralf Förster 2007-10-13 08:26:12 UTC 
Created attachment 13143 [details]
udp packets sniffed with wireshark

Ok, I'll close this bug  - however I'm wondering why I always get with tcpdump only SSDP packets whereas with wireshark I observed udp messenger packets and others as seen in this attachment.
Note You need to log in before you can comment on or make changes to this bug.