Sample Header Ad - 728x90

Cannot see packets arrive on application socket that were seen by Wireshark

9 votes
3 answers
7559 views
Using Ubuntu 14 I have a Linux machine where there are two interfaces: eth1: 172.16.20.1 ppp0: 192.168.0.2 ppp0 is connected to a device which has a PPP interface (192.168.0.1) and a WAN interface (172.16.20.2). I can verify that this device can reach 172.16.20.1 The problem I am having is if I send a packet using Python on the same machine: # client.py import socket cl = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) cl.sendto("Hello", ("172.16.20.1", 5005)) # server.py import socket srv = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) srv.bind(("", 5005)) while True: data, addr = srv.recvfrom(2048) print("Message: ", data) the script works fine but I cannot see the packet on Wireshark coming out of eth1 (I can only see it when I choose to capture on the lo interface). I assume the OS has detected the packet is for one of its local interface and does not send it through the 192.168.0.2 socket created. When I add the following rules to prevent this from happening: sudo ip route del table local 172.16.20.1 dev eth1 sudo ip route add table local 172.16.20.1 dev ppp0 sudo ip route flush cache What happens is: - I can see the packets on Wireshark now arriving at eth1, the source address is the address of the WAN (172.16.20.2) - I cannot see any output from server.py after restarting the program. **Ignoring the ppp0 interface and using two ethx interfaces:** If I try to run the program in two (client and server) separate machines (without applying the rules), I can see the packets arriving at eth1 in Wireshark, and the output on server.py. If I try to run the program in two separate machines AND I apply the rules above for the ppp0 connection (I have not removed it), I can no longer see any output from server.py but can still see packets arriving on Wireshark. My knowledge of the TCP/IP stack is not good, but it looks like the link layer is no longer forwarding to the application layer?
Asked by nnja (199 rep)
Jan 17, 2018, 04:09 AM
Last activity: May 19, 2025, 01:08 PM