I am trying to understand the packet traversal in Linux. I found a diagram from link.

My linux box has the following routing table:

default via dev wlan0  proto static  metric 1024 dev wlan0  scope link  metric 1000 dev wlan0  proto kernel  scope link  src

If I send a ping to

  • It would first pass OUTPUT table rules
  • The routing decision will check routing table and use the default route which states using the device wlan0
  • It will pass POSTROUTING rules and will be send out on wlan0

For the ping response, assuming it arrives on wlan0, it would first pass the PREROUTING rules. My question is that at this point, what will it gain by checking the routing table because the diagram suggest a routing decision is made; or is it just to check if a packet does not have IP associated with any of the interfaces on the machine ?

  • Your diagram is a diagram of how packets progress through IPTABLES, not how the raw networking stack works. All that IPTABLES stuff happens before the packet even gets to the underlying network stack, and it allows you to do a lot of things with packets, like rewrite source and destination IPs and ports, or otherwise altering, dropping, or blocking packets. Then... after they get through that, they finally reach the network stack. Read this instead: cubrid.org/blog/understanding-tcp-ip-network-stack – Tim Kennedy Mar 21 '19 at 3:30
  • @TimKennedy I may have been confused because I also saw this diagram en.wikipedia.org/wiki/Netfilter#/media/… .. which kind of shows iptable sequence in the network stack – Jake Mar 21 '19 at 3:32
  • @TimKennedy Do you know any online resource that shows a full picture containing TCP/IP stack and netfilter ? Thanks – Jake Mar 21 '19 at 3:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.