Re: truncated-ip 4.1.32_rc5 (wrong IP header byte swapping?)

Darren Reed <[email protected]>
Newsgroups gmane.comp.security.firewalls.ipfilter
Message-ID <22341_1241115979_49F9ED4B_22341_2556_1_49F9EBD6.6040304@reed.wattle.id.au>
Jim Klimov wrote:
> ...
>
> Just for kicks, I tried to comment away the whole block
> of these 2-4 lines you patched, to see what happens.
>
> I found that with without these lines our new gateway
> appears in the traces, as well as our next-hop cisco.
> Further hosts on the route thru internet do not respond,
> except for the destination host ("www.ru" = 194.87.0.50,
> a popular network-checking target here in Russia).
>
> During the previous tests it sometimes replied to the
> traceroutes, but sometimes it didn't. With htons/ntohs
> lines commented, it always replied.

Ok... so those lines need to be there...

With them there, what do you see from this when you try to traceroute:

dtrace -n 'fbt::fr_check:return{trace(arg1);}' -n
'fbt::ipf_hook:return{trace(arg1);}' -n 'fbt::ipf_hook:entry{self->hdr =
((hook_pkt_event_t *)arg1)->hpe_hdr;}' -n
'fbt::fr_check:entry{printf("len %d", ((struct ip *)self->hdr)->ip_len);}'

Darren
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.