I'm moving an application from 2.6.23 (yes, it's ancient; that's why we are moving) to 3.18LTS. The application monitors multiple network links to the same target with ping packets. The different links are selected either by their next hop router (Ethernet) or the network interface (Point-to-Point links, aka cellular data). To force different routes to the same target, the outgoing packets are tagged with different firewall marks. Then I'm using routing rules to select different routing tables with different routes for the same target. The outgoing path works perfectly fine in both, 2.6.23 and 3.18. However, the same is not true for the incoming ICMP replies. They are incoming; I see them with tcpdump. But some packets do not get delivered to user space in 3.18. I'm not 100% sure, but I think this happens if there is no "normal" route to the ping target, e.g. the source address of the ICMP replies. This looks like some kind of misguided ingress filtering that keeps packets out if a normal routing lookup fails.

Am I on the right track? If so, is there a way to disable this filtering? If not, what could cause this changed behaviour?


OK, found it myself.

The answer is /proc/sys/net/ipv4/conf/*/rp_filter. The option is documented at the Linux Foundation. While this is an old setting, it seems that Ubuntu changed the default value sometime between 07.04 and 14.04. Changing the value from 1 back to 0 fixed my problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.