I do need a log of packets which are dropped by rp_filter ... how to do this logging ?
which logs how to enable.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
As far as I know those are not logged. Unless somebody else proves me wrong, here's an alternate method.
What you can do instead is steps 1+2 or 1+3 below:
disable rp_filter completely.
use iptables' rpfilter match module, once with the LOG target for simple log, or NFLOG (or even NFQUEUE though that's not the intended usage) for full packet dump, and once with the DROP target to actually filter.
Using NFLOG correctly would probably require a separate question on its own, but I can tell that even without a specialized tool,
tcpdump can listen to a nflog netlink socket as if it was an interface. Usually done first with:
# tcpdump -D
to retrieve the correct interface index. Eg:
12.nflog (Linux netfilter log (NFLOG) interface) 13.nfqueue (Linux netfilter queue (NFQUEUE) interface)
# tcpdump -n -i 12 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on nflog, link-type NFLOG (Linux netfilter log messages), capture size 262144 bytes
You could choose to write them to a file too (
Using netfilter's firewalling layer is the only method for IPv6 which lacks direct support for rp_filter in its routing stack on Linux.
Some corner cases related to ARP or policy routing might not behave 100% identically because the filtering is probably done later.
You have to enable the sysctl
net.ipv4.conf.default.log_martians, then check the syslog file you should have something like:
[8270435.701764] ll header: 00000000: ce 47 b8 a3 39 62 de 2e 40 0c a0 0c 08 00 .G..9b..@..... [8270435.702460] IPv4: martian source 188.8.131.52 from 10.138.86.16, on dev tap12