Re: Filtering arp on vlan trunk interface

Op vr, 31-08-2007 te 13:51 -0500, schreef Grant Taylor:

> > I never used ARPtables, where does it hook into the packet flow? 
> > Before ebtables or after ebtables? I will definetly have a look at 
> > it.
> 
> I don't know for sure.

After, which one can easily verify.

> > This question was more about at what point tcpdump gets fed with the 
> > packet headers. From my point of view it should happen after all 
> > filtering is done, as it is a userspace tool and ebtables/iptables 
> > filtering happens in kernelspace, right?
> 
> Don't know this one either.

tcpdump uses raw sockets in Linux and it therefore sees all packets
before ebtables, iptables, routing, etc. So if a packet destined to the
bridge (br0) arrives at bridge port eth0 and you're dropping every
packet in ebtables PREROUTING, tcpdump -i eth0 will still show the
packet while tcpdump -i br0 won't show anything.

cheers,
Bart



-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/