Re: my linux does not accept redirects

Re: my linux does not accept redirects

[Chuck Ebbert]

> The ARP protocol finds the physical address, the IEEE
> station address of a particular host and talks to it using
> that address. If the IP address is behind a router, then
> the router answers the ARP request with its physical address.


Damn Cisco and their default proxy ARP settings...

While learning to use iproute2 I managed to set my local eth0
interface as the default route.  Boy was I suprised to see the
router's ARP reply for a network address far, far away!

--
 Chuck

my linux does not accept redirects

[Maciej Soltysiak]

Hi,

There are 2 routers on my network.
Router A routes to other internal networks
Router B routes to the Internet

My box has A as the default gateway.
It should get redirects for the Internet hosts and it does.
But despite icmp redirects are not filtered and
/proc/sys/net/ipv4/conf/eth1/accept_redirects is 1 it does not learn
the paths and i simply get flooded by the router with redirects about
every single packet that is sent.

What could be wrong?

Regards,
Maciej Soltysiak

Re: my linux does not accept redirects

[Richard B. Johnson]

On Wed, 2 Apr 2003, Maciej Soltysiak wrote:

> Hi,
>
> There are 2 routers on my network.
> Router A routes to other internal networks
> Router B routes to the Internet
>
> My box has A as the default gateway.
> It should get redirects for the Internet hosts and it does.
> But despite icmp redirects are not filtered and
> /proc/sys/net/ipv4/conf/eth1/accept_redirects is 1 it does not learn
> the paths and i simply get flooded by the router with redirects about
> every single packet that is sent.
>
> What could be wrong?
>

How would it learn? If everybody is going to set their default
route to your box A, and box A routes internally, then box A needs its
default route to go to the internet-box B.

The existnce of ICMP redirects means that your network is not
configured correctly. They are a symptom. A correctly configured
network does not have ICMP redirects.

Cheers,
Dick Johnson
Penguin : Linux version 2.4.20 on an i686 machine (797.90 BogoMips).
Why is the government concerned about the lunatic fringe? Think about it.

Re: my linux does not accept redirects

[Maciej Soltysiak]

> >
> > What could be wrong?
> >
>
> How would it learn? If everybody is going to set their default
> route to your box A, and box A routes internally, then box A needs its
> default route to go to the internet-box B.
>From my investigation i have found that my box stores routes based on
icmp redirects (as seen with netstat -C) and it does learn the routes
but not for all routes. Please look at this printout:

<snip>
dns.toxicfilms. trek13.sv.av.co nihil.ae.poznan       0      0        4 eth1
dns.toxicfilms. nms.cyf-kr.edu. alnair.ae.pozna       0      0        6 eth1
<snip>

dns.toxicfilms.tv is my box

nihil.ae.poznan.pl is the router that routes to my other public nets
alnair.ae.poznan.pl is the Internet Gateway.

Why did not my box learn to send packets to trek13.sv.av.com via alnair ?

it's 2.4.20-xfs, no other patches.
I am running a similar box on the same net with 2.5.66-mm2 and i do not
see this effect, thus i presume, it's not a configuration error.

Having one default route via Router A (nihil) should cause only one
redirect per one connections. But i get flooded for every packet.

Regards,
Maciej

Re: my linux does not accept redirects

[Richard B. Johnson]

On Thu, 3 Apr 2003, Maciej Soltysiak wrote:

> > >
> > > What could be wrong?
> > >
> >
> > How would it learn? If everybody is going to set their default
> > route to your box A, and box A routes internally, then box A needs its
> > default route to go to the internet-box B.
> >From my investigation i have found that my box stores routes based on
> icmp redirects (as seen with netstat -C) and it does learn the routes
> but not for all routes. Please look at this printout:
>

No it doesn't! If your box "finds" routes then it has `routed` or
`gated` installed and running. Otherwise it uses static routes and
has no way of "learning" anything you didn't tell it.

> <snip>
> dns.toxicfilms. trek13.sv.av.co nihil.ae.poznan       0      0        4 eth1
> dns.toxicfilms. nms.cyf-kr.edu. alnair.ae.pozna       0      0        6 eth1
> <snip>
>
> dns.toxicfilms.tv is my box
>
> nihil.ae.poznan.pl is the router that routes to my other public nets
> alnair.ae.poznan.pl is the Internet Gateway.
>
> Why did not my box learn to send packets to trek13.sv.av.com via alnair ?
>

Because networking doesn't work that way. Packets are routed directly
to hosts if the host address fits inside the netmask. If the host
address is outside that network, packets are routed to the default
address which should be a host or other gatweay that connects with
the outside world.

If you have multiple isolated subnets, they work the same way.
However, the host that gets the default-route packets needs to
further route these packets both internally and externally.

> it's 2.4.20-xfs, no other patches.
> I am running a similar box on the same net with 2.5.66-mm2 and i do not
> see this effect, thus i presume, it's not a configuration error.
>

Then find out what's different. Probably the netmask on one is
different than on the other. It's the netmask that defines the
"width" of a network. Any address that fits inside that netmask
goes directly to a host on that network. Anything that falls
outside goes out the default route.

> Having one default route via Router A (nihil) should cause only one
> redirect per one connections. But i get flooded for every packet.
>

It will have NO, none, not any, redirects --ever. Redirects are an
attempt by a host to work around a severe problem. Communications
(datagram) packets are never redirected, only ICMP or ARP packets.
The ARP protocol finds the physical address, the IEEE station address
of a particular host and talks to it using that address. If the
IP address is behind a router, then the router answers the ARP request
with its physical address. Therefore, the host communicating with
an IP address behind a router ends up talking to the router.


Cheers,
Dick Johnson
Penguin : Linux version 2.4.20 on an i686 machine (797.90 BogoMips).
Why is the government concerned about the lunatic fringe? Think about it.