We have a vm centos 5.x in a vmware infra that works fine.

It has 2 nics and some traffic coming from outside to one of the nic's ip on port UDP 514 and 516.

I see with tcpdump the traffic coming to the ip/port and netcat shows me that the ip and port receive the packet (those are syslog messages so I can see them).

We wanted to upgrade the VM to Centos 7.1. Same Nic, same IP, no much more hardening, pretty simple.

So we create a new Centos 7.1 vm, same vmware network, same esx.

Now, I still can see the traffic coming from outside the vm to the Nic's ip and port but a netcat on udp 516 shows nothing at all. On udp 514 it works. And I use the exact same commands.

No iptables or selinux.

I use the exact same tcpdump or netcat commands on both vms to do my tests.

If I switch to the old Centos 5 vm, then everything is back to normal: tcpdump show trafic on udp 514 and 516, netcat of udp 514 and 516 show the messages.

This thing driving crazy because I don't see any logical reaason for this. I will test with a vanilla Centos 7.2 but in the meantime I am wondering if someone somewhere in this universe already have this kind of issue.

Thanks for your help!

  • So your question could be summarized as "how can traffic reach the network interface but not end-user programs, only for specific ports, when no firewall is involved"? Perhaps it would be useful to know the kernel versions. Have you tried even more UDP ports to see which work and which do not? – dhag Jun 21 '17 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.